specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: CVS Health
providerId: cvs-health
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Healthcare
  - Pharmacy
  - Health Insurance
  - FHIR
  - Rate Limiting
description: CVS Health does not publish public API rate-limit numbers. Patient-access FHIR endpoints
  enforce per-app and per-member soft caps consistent with CMS rule guidance; partner integrations are
  throttled per contract.
sources:
  - https://www.cvshealth.com/
notes: Specific RPS / RPM thresholds are not published publicly. SMART-on-FHIR apps are subject to per-app
  limits set during developer registration.
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Patient access FHIR
    scope: app
    metric: varies
    limit: per-app limits set at SMART-on-FHIR registration
    applies:
      - CVS Health Partner Integrations
  - name: Partner integration
    scope: partner
    metric: varies
    limit: per partner integration agreement
    applies:
      - CVS Health Partner Integrations
policies:
  - name: Backoff Strategy
    description: Honor Retry-After when present; use exponential backoff with jitter on 429 / 503.
  - name: PHI handling
    description: All access is patient-authorized via SMART-on-FHIR or partner agreement; tokens have
      short lifetimes and must be rotated.
  - name: Contract-scoped throughput
    description: Partner integration TPS is set in the integration agreement, not on a public docs page.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com