Limits
Every number in one place. Limits marked key setting are chosen when the key is created; the rest are the same for everyone.
#Per key
| What | Limit | Over the limit |
|---|
| Read requests | 20 per second, bursts of 40 | 429 rate_limited |
| Write requests | 5 per second, bursts of 10 | 429 rate_limited |
| Orders (opens, closes, cancels) | Key setting: 30 per minute by default, up to 120 | 429 order_rate_limited |
| Changes (stops, targets, prices, expiry) | Key setting: 60 per minute by default, up to 240 | 429 modification_rate_limited |
| Volume per order | Key setting: 1.00 lot by default | 422 volume_limit_exceeded |
| Open positions and pending orders | Key setting: 20 by default, up to 200 | 422 position_limit_exceeded |
| Daily loss | Key setting: 10% of the day's starting equity by default | 403 daily_loss_limit_reached |
| Stream connections | 2 (a third replaces the oldest) | Oldest closes with 4409 |
| Lifetime | 1–365 days, 90 by default; a rolled key's old secret works for 24 hours | 401 api_key_expired |
#Per account
| What | Limit | Over the limit |
|---|
| Active API keys | 10 | Revoke one before creating another |
| Orders across all keys | 60 per minute | 429 order_rate_limited |
| Changes across all keys | 240 per minute | 429 modification_rate_limited |
#Per IP address
| What | Limit | Over the limit |
|---|
| REST and MCP requests, all keys together | 50 per second, bursts of 100 | 429 rate_limited |
#Per request
| What | REST | MCP |
|---|
| Request body | 64 KB | 64 KB |
| Instruments per quotes call | 50 | 20 |
| Candles per call | 1–2000, default 500 | 1–500, default 100 |
| History window | Up to 90 days, default 7 | Up to 90 days, default 7 |
| History page size | 1–1000, default 100 | 1–200, default 50 |
Waiting for a held decision (wait) | 0–10 seconds, default 5 | 5 seconds |
Idempotency-Key | 1–64 characters; remembered for 72 hours |
comment / client_tag | 200 characters / 32 characters |
| Proposal lifetime | 10 minutes |
#Streaming
| What | Limit |
|---|
Authenticating with an auth frame | Within 5 seconds of connecting |
| Quote instruments per connection | 100 |
| Candle series per connection | 20 |
| Quote updates | At most 4 per second per instrument |
| Account updates | At most 1 per second |
Order event replay (since_seq) | The last 5 minutes, including while you are disconnected |
| Heartbeat | Every 20 seconds |
| Frames you send | 16 KB |
| Unsent data before frames are skipped / the connection closes | 1 MB / 4 MB (order events are never skipped) |
#Security
After 10 failed authentications in a minute from one IP address, that address is blocked for 10 minutes.
