specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Humana
providerId: humana
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Rate Limiting
  - FHIR
  - Healthcare
  - CMS
description: Humana's developer portal does not publish numeric rate limits for its FHIR APIs. Limits
  are administered behind the scenes consistent with CMS Patient Access expectations and reasonable-use
  protections, scoped per registered application and per member token. Production apps that exceed
  fair-use thresholds are contacted directly. Sandbox endpoints are bound by similar reasonable-use
  ceilings without published numbers.
notes: Specific per-second / per-minute numbers are not publicly disclosed. The developer portal
  is scheduled to be retired; successor portal may publish updated limits.
sources:
  - https://developers.humana.com/
  - https://fhir.humana.com/api/metadata
  - https://www.cms.gov/regulations-and-guidance/guidance/interoperability/index
limits:
  - name: Patient Access FHIR requests (production)
    scope: app + member_token
    metric: requests_per_second
    limit: not publicly published; reasonable-use enforcement
    notes: Member-authorized FHIR queries; throttled to protect platform but no public RPS number.
  - name: Provider Directory FHIR requests
    scope: app
    metric: requests_per_second
    limit: not publicly published; reasonable-use enforcement
  - name: Drug Formulary FHIR requests
    scope: app
    metric: requests_per_second
    limit: not publicly published; reasonable-use enforcement
  - name: Sandbox FHIR requests
    scope: ip
    metric: requests_per_second
    limit: not publicly published; reasonable-use enforcement
    notes: Sandbox uses synthetic data; no member PHI risk but limits still apply.
policies:
  - name: SMART on FHIR Authorization
    description: Production member data access requires SMART on FHIR / OAuth 2.0 with explicit member
      consent. Tokens are short-lived and refresh tokens are subject to revocation.
  - name: Application Attestation
    description: Developer apps must attest to CMS privacy / data use practices before production
      access is granted.
  - name: Backoff Strategy
    description: Implement exponential backoff and honor any Retry-After response header; pace requests
      conservatively given the absence of published numeric limits.
  - name: Sandbox vs Production
    description: Test against the sandbox at sandbox-fhir.humana.com before promoting to fhir.humana.com.
      Production apps require completed registration.
  - name: Portal Migration
    description: The developers.humana.com portal will be retired; FHIR products and consuming apps
      will migrate to a successor portal. Watch for migration guidance.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com