API Configuration and Limits

Request the API limits endpoint when your application starts, after resolving the access point for the account.

GET /v1/configuration/accounts/{account_id}/limits

This endpoint returns the effective REST limits, WebSocket limits, throttling values, and request-shape constants for the current account and API key. REST limits apply to the complete AP cluster. WebSocket limits are enforced per server node.

Do not hardcode limits. API conditions may vary by account, API key, endpoint group, and current API configuration. Always use the values returned by this endpoint.

What the endpoint returns

The response contains a top-level limits object.

Section	What it contains	How to use it
limits.rest.global_account_rate	Account-level REST rate window.	Track total REST request volume locally.
limits.rest.methods[]	Effective rate limit and OpenAPI metadata for each REST operation.	Match the request by api_operation_id, http_method, or path.
limits.rest.methods[].rate_limit	Operation-specific REST rate limit.	Apply limit and window_seconds before sending a request.
limits.rest.methods[].limits	Request-shape constants for the operation, when returned.	Apply constants such as max_candles_per_request, history_range_days, and history_age_days.
limits.websocket.global_account_limits	Account-level WebSocket limits on one server node.	Limit active connections, inbound message size, connection rate, and inbound message rate.
limits.websocket.endpoints[]	Effective WebSocket limits for each stream endpoint.	Match by endpoint path and apply endpoint-level connection, message, and subscription limits.
limits.websocket.endpoints[].subscription_operation_rate	Token-bucket limits per subscription type.	Throttle subscribe requests by endpoint and event type.

The endpoint returns configured limits. It does not return the client's current remaining quota. The client must calculate available request capacity locally.

Startup flow

1. Prepare credentials.
2. Resolve the access point for the account.
3. Request GET /v1/configuration/accounts/{account_id}/limits.
4. Store the returned limits and request constants in memory.
5. Apply endpoint-specific limits before sending requests.
6. Apply client-side throttling and backoff.
7. Refresh limits periodically or after relevant rate-limit errors.

REST capacity calculation

For each REST request:

1. Find the matching method in limits.rest.methods[].
2. Read rate_limit.limit and rate_limit.window_seconds.
3. Count matching requests already sent by the client in the current window.
4. Send the request only when local usage is below the returned limit.
5. If capacity is not available, wait for the next window or apply backoff.

limits_response = client.get(f"/v1/configuration/accounts/{account_id}/limits")

method_limits = next(
    item for item in limits_response["limits"]["rest"]["methods"]
    if item["api_operation_id"] == "openPosition"
)

limit = method_limits["rate_limit"]["limit"]
window_seconds = method_limits["rate_limit"]["window_seconds"]

if local_request_count("openPosition", window_seconds) < limit:
    send_open_position_request()
else:
    wait_until_capacity_is_available()

Request-shape constants

Some REST operations return additional request-shape constants under limits.rest.methods[].limits.

Use these values before building a request. For example, historical market data requests may include:

• max_candles_per_request;
• history_range_days;
• history_age_days.

If a constant is returned by the limits endpoint, treat it as the current effective value for that account and API key.

WebSocket throttling

Use limits.websocket to control:

• active WebSocket connections;
• maximum inbound message size;
• connection rate;
• inbound message rate;
• subscribe-operation rate by stream endpoint and event type.

For live ticks, connect to:

/v1/server-events/accounts/{account_id}/ws/ticks

Use this subscription payload:

{
  "id": "ticks-xauusd-1",
  "subscribe": {
    "event": "ticks",
    "instruments": ["XAUUSD"]
  }
}

For transactions, account state, instruments, and HMR, use:

/v1/server-events/accounts/{account_id}/ws/events

Rate-limit errors

When the API returns HTTP 429 or REQUEST_RATE_LIMIT:

1. Do not retry immediately in a loop.
2. Refresh limits if your local configuration may be stale.
3. Recalculate local capacity.
4. Wait until capacity is available.
5. Retry only if the operation is still needed and safe to retry.

Do not assume that another account, API key, endpoint, or endpoint group has the same limits.