Rate limits
Rate limiting rules for HGV Traders API endpoints.
Overview
Rate limits protect the API from abuse. Limits apply by route class, not per bearer token. When exceeded, the API returns 429 Too Many Requests with a Retry-After header (seconds until the window resets).
See Errors for the error response format.
Limits by route class
| Route class | Limit | Key |
|---|---|---|
POST /api/v1/auth | 8 attempts / 15 minutes | Client IP + email address |
GET /api/v1/jobs, /events, /posts (list and detail) | 60 requests / minute | Client IP |
Bearer routes (GET /api/v1/me, GET/PATCH /api/v1/accounts, POST /api/v1/notification_tokens) | No dedicated limit | — |
| Bearer write routes (stock, jobs, enquiries, uploads) | 120 requests / minute | Authenticated user ID |
Auth endpoint
POST /api/v1/auth is keyed on ip:email so one attacker cannot lock out every account, and one account cannot be hammered indefinitely from a single source.
Public read endpoints
Unauthenticated list and detail routes for jobs, events, and posts share a per-IP read limit of 60 requests per minute.
Best practices
- Cache public read responses where appropriate.
- Honour
Retry-Afteron 429 responses — do not retry immediately. - Prefer dashboard-minted tokens over repeated
POST /api/v1/authcalls to avoid hitting the auth limit.