name: Fortify API Rate Limits
specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Fortify
providerId: fortify
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Application Security
  - DAST
  - SAST
  - SCA
  - Rate Limiting
description: Fortify on Demand exposes a REST API at api.emea.fortify.com / api.ams.fortify.com / api.apac.fortify.com with OAuth2 client credentials. OpenText does not publish numeric per-second rate limits in the public docs; throttles are per-tenant and oriented around long-running scan submission and result-retrieval operations. Self-managed Fortify SSC has no platform-imposed API limit.
notes: No public RPS/RPM table from OpenText. Scan submission is async and rate-limited by tenant; treat scan endpoints as bulk async rather than high-frequency.
sources:
  - https://www.opentext.com/products/fortify-on-demand
  - https://www.opentext.com/products/fortify
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Fortify on Demand REST API per-tenant throttle
    scope: tenant/api-key
    metric: varies
    limit: per-tenant; not publicly published
    applies:
      - Fortify on Demand REST API
  - name: Fortify SSC self-hosted
    scope: deployment
    metric: requests_per_second
    limit: operator-configured; no platform default
    applies:
      - Fortify Software Security Center API
policies:
  - name: Async Scan Submission
    description: Static, dynamic, and mobile scan submissions return a scan ID immediately and run asynchronously. Poll the scan-status endpoint with backoff rather than re-submitting.
  - name: Backoff Strategy
    description: Clients should implement exponential backoff with jitter on 429/5xx and honor Retry-After.
  - name: Token Lifetime
    description: OAuth2 access tokens have limited lifetime; refresh ahead of expiry rather than retrying after 401.
  - name: Region Routing
    description: Use the region-specific FoD endpoint (EMEA, AMS, APAC) matching the tenant; cross-region calls are not supported.
maintainers: []