specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Cigna
providerId: cigna
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - CMS Interoperability
  - FHIR
  - Healthcare
  - Patient Access
  - Provider Directory
  - Rate Limiting
description: Cigna does not publish a numeric per-second or per-minute rate-limit policy on its
  public developer portal for the FHIR API surface. The endpoints (Patient Access, Provider Directory,
  Drug Formulary, Provider Access) are governed by HIPAA, CMS Interoperability rules, and Cigna's
  application-onboarding terms. Practical limits are imposed at the WAF / API-gateway layer and on
  the SMART on FHIR token issuer; client applications that exceed fair-use thresholds are throttled
  with a 429 response and may be contacted by Cigna's developer-relations team.
notes: No public per-second / per-minute rate-limit numbers are documented. Approved applications
  receive guidance through the developer-portal onboarding process.
sources:
  - https://developer.cigna.com/
  - https://developer.cigna.com/docs/service-apis
  - https://developer.cigna.com/support
responseCodes:
  throttled: 429
  unauthorized: 401
  forbidden: 403
  serverError: 500
  serviceUnavailable: 503
limits:
  - name: FHIR API requests
    scope: application
    metric: varies
    limit: 'see Cigna developer onboarding documentation; not publicly documented'
    notes: Practical ceilings are applied at the WAF and applied per registered application client_id.
  - name: SMART on FHIR token issuance
    scope: application
    metric: varies
    limit: 'governed by OAuth issuer; not publicly documented'
    notes: Token issuance for member-authorized Patient Access is rate-limited by the OAuth server.
policies:
  - name: Backoff Strategy
    description: On 429 / 5xx, retry with exponential backoff and jitter; honor Retry-After when
      present.
  - name: SMART on FHIR
    description: Member-authorized Patient Access requires SMART on FHIR / OAuth 2.0 authorization
      with member consent before claims and clinical data can be queried.
  - name: Pagination
    description: FHIR Bundle responses are paginated via the standard Bundle.link 'next' relation.
      Iterate cursors rather than issuing high-offset requests.
  - name: HIPAA / CMS Compliance
    description: Application sponsors are accountable for HIPAA-aligned handling of any PHI returned
      by the Patient Access and Provider Access APIs.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com