specificationVersion: "0.1"
id: demostack-rate-limits
name: Demostack Rate Limits
generated: '2026-08-14'
method: searched
source: https://www.demostack.com/integrations
url: https://www.demostack.com/integrations
limit_count: 0
description: >-
  Demostack publishes no rate limits. There is no public API reference to carry
  them, the integrations page and the public help-center articles state none, and
  no rate-limit response headers can be observed because every anonymous request
  to api.demostack.com returns 403 and the MCP endpoint returns 401 before any
  quota is applied. Thresholds, if any, are set inside the enterprise contract.
limits: []
response_headers:
  observed: []
  documented: []
  exhaustion_status: null
  retry_after: null
  note: >-
    No X-RateLimit-*, RateLimit-* or Retry-After header was returned on any
    anonymous response from api.demostack.com or mcp.demostack.com.
evidence:
  - url: https://www.demostack.com/integrations
    http_status: 200
    finding: Advertises webhooks and Demostack MCP; states no limits, quotas or throttling behavior.
  - url: https://api.demostack.com/
    http_status: 200
    finding: Returns the 12-byte body "Health Check" with no rate-limit headers.
  - url: https://mcp.demostack.com/mcp
    http_status: 401
    finding: >-
      OAuth challenge only. WWW-Authenticate carries error="invalid_token" and
      resource_metadata; no rate-limit headers are present.
  - url: https://help.demostack.com/migration/articles/demostack-and-salesforce-integration-technical-guide
    http_status: 200
    finding: >-
      Documents the OAuth flow and the ten custom Salesforce Activity fields but
      states no Demostack-side rate limits.
correction:
  date: '2026-08-14'
  detail: >-
    A previous revision of this file listed four numeric limits — 60 webhook
    events/minute, 1,000 CRM syncs/hour, 30 MCP queries/minute, 50 demo clones/day
    — each annotated "estimated". Demostack publishes none of those numbers.
    Estimates recorded in a limits[] array are indistinguishable downstream from
    limits the provider actually published, so they have been removed in favour of
    an honest limit_count of 0.