Rate limiting is implemented to ensure fair usage of the WhatsApp API service and to prevent abuse.
Our API implements rate limiting to ensure stable service for all users. When you exceed your rate limit, requests will be rejected with a 429 Too Many Requests status code until the rate limit window resets.
All API responses include headers that provide information about your current rate limit status:
| Header | Description |
|---|---|
X-RateLimit-Limit |
The maximum number of requests allowed in the current time window |
X-RateLimit-Remaining |
The number of requests remaining in the current time window |
X-RateLimit-Reset |
The time at which the current rate limit window resets, in Unix epoch seconds |
Retry-After |
Only present when rate limited. Indicates how many seconds to wait before making another request |
HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1726483200
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1726483200
Retry-After: 60
{
"success": false,
"error": {
"code": "rate_limit_exceeded",
"message": "Rate limit exceeded. Please try again in 60 seconds."
}
}
Rate limits vary based on your subscription plan and the specific API endpoint being accessed.
| Plan | Requests per Minute | Requests per Hour | Requests per Day |
|---|---|---|---|
| Free | 10 | 100 | 1,000 |
| Basic | 60 | 1,000 | 10,000 |
| Premium | 300 | 5,000 | 50,000 |
| Enterprise | 1,000 | 20,000 | 200,000 |
Some endpoints have specific rate limits regardless of your plan:
| Endpoint | Rate Limit | Window | Notes |
|---|---|---|---|
/api/v1/sessions (POST) |
5 requests | Per hour | Creating new sessions is limited to prevent abuse |
/api/v1/messages/bulk |
1 request | Per minute | Bulk message sending is heavily rate limited |
/api/v1/media/* |
30 requests | Per minute | Media upload/download operations |
/api/v1/webhooks/test |
5 requests | Per hour | Testing webhooks is limited to prevent abuse |
To effectively work with our rate limits, we recommend the following practices:
Retry-After header to determine how long to wait before retrying.async function makeApiRequest(url, options, maxRetries = 3) {
let retries = 0;
while (retries < maxRetries) {
try {
const response = await fetch(url, options);
// Check rate limit headers
if (response.status === 429) {
// Rate limited - get retry time from header
const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
// Wait for the specified time
await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
retries++;
continue;
}
return await response.json();
} catch (error) {
retries++;
if (retries >= maxRetries) {
throw new Error(`Failed after ${maxRetries} retries`);
}
// Exponential backoff
const backoffTime = Math.pow(2, retries) * 1000;
await new Promise(resolve => setTimeout(resolve, backoffTime));
}
}
}
import requests
import time
def make_api_request(url, options, max_retries=3):
retries = 0
while retries < max_retries:
try:
response = requests.request(
method=options.get('method', 'GET'),
url=url,
headers=options.get('headers', {}),
json=options.get('json'),
data=options.get('data')
)
# Check rate limit headers
remaining = response.headers.get('X-RateLimit-Remaining')
limit = response.headers.get('X-RateLimit-Limit')
print(f"Rate limit: {remaining}/{limit}")
if response.status_code == 429:
# Rate limited - get retry time from header
retry_after = int(response.headers.get('Retry-After', 60))
print(f"Rate limited. Retrying after {retry_after} seconds")
# Wait for the specified time
time.sleep(retry_after)
retries += 1
continue
return response.json()
except Exception as e:
print(f"API request failed: {e}")
retries += 1
if retries >= max_retries:
raise Exception(f"Failed after {max_retries} retries")
# Exponential backoff
backoff_time = 2 ** retries
time.sleep(backoff_time)
If you need higher rate limits than what your current plan provides, you have the following options:
Note: Repeatedly exceeding rate limits may result in temporary or permanent restrictions on your API access. Always implement proper rate limit handling in your applications.