FinDesk applies Laravel's default api throttle to every authenticated route. Public endpoints (POST /login, POST /register, webhook receivers) share the same default.
The limit
The current limit is 60 requests per minute, the Laravel Sanctum default for the api middleware group. Authenticated requests are counted per-user; unauthenticated requests are counted per-IP.
This is a server-wide default — no custom RateLimiter::for('api', ...) is registered for the API surface today. If you need higher throughput for a specific integration, contact FinDesk support so it can be lifted on your account.
Response headers
Every response from a throttled route includes the current counter state:
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
When the limit is exceeded the request short-circuits with 429 Too Many Requests and adds:
Retry-After: 23
X-RateLimit-Reset: 1748557200
Retry-After is the number of seconds until the next request will be accepted. X-RateLimit-Reset is the same instant expressed as a Unix timestamp.
The body of a throttled response is the standard Laravel message:
{
"message": "Too Many Attempts."
}
Handling 429s
- Read
Retry-Afterand wait at least that long before retrying — don't reissue the same call immediately. - Apply jitter when retrying from concurrent workers so they don't synchronise and hit the limit on the next minute as well.
- For bulk imports, page sequentially rather than fanning out; the 100-records-per-page default (see Pagination) is sized so a full sync fits comfortably within the per-minute budget.