# Quotas and constraints

Review quotas and constraints within Redox. Talk to your Technical Account Manager if you have questions about these. 

## Message and file size limits

Redox has message and file limits for both incoming and outgoing traffic. If a message exceeds these limits, the message will error. 

| **Type of traffic** | **Size limit** |
| --- | --- |
| Redox API traffic (e.g., Redox Data Model API or Redox FHIR API) | 40 MB |
| Network Onramps (e.g., Carequality Interoperability Framework, TEFCA, CommonWell) | 40 MB |
| HL7v2 messages over MLLP | 30 MB |
| Uploaded files | 30 MB |
| All other integrations or APIs | 10 MB |

## Rate limiting quota

To protect you and our other customers, we employ <u>rate limiting</u> across our APIs. You can make up to 10,000 requests every five minutes per user as determined by IP address. [Learn about rate limiting](https://www.cloudflare.com/learning/bots/what-is-rate-limiting/).

> **Rolling window**
>
> The five-minute window for rate limiting is a rolling window. If you receive an error for exceeding the limit, you don't have to wait for five minutes from the time the error was triggered. Instead, you only need to wait until that five-minute window is over.
>
> For example, if you send 7,500 requests within three minutes and you receive an error, you only need to wait two more minutes before retrying.

> **Lower rate limits**
>
> For security reasons, some API requests have lower rate limits than the standard 10,000 per five minutes. For example, when using any of our DevTools, the rate limit decreases to five API requests per five minutes. 
>
> However, the error message and our recommendation for handling exceeding rate limiting is the same. 

### Exceeding the limit

If your IP address exceeds this limit—until the 5-minute window has elapsed—we respond to requests by:

- sending an HTTP `429` status code response ([learn about HTTP 429 status](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429)), and
- adding an `X-RateLimit-Limit HTTP` response header with the current limit (7,500).

### Throttling

This limit should be sufficient for any nominal operation, but it may cause issues during backfilling. We expect you to throttle your API requests to stay within this limit. If this isn’t possible, [submit a ticket to our Help Center](https://redoxengine.zendesk.com/hc/en-us) to examine alternative options.