specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Huntington Bancshares
providerId: huntington-bancshares
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Rate Limiting
  - Banking
  - Treasury
  - Open Banking
description: Huntington's developer portal does not publish numeric rate limits. The platform is
  built on Apigee X and Apigee enforces per-API-product quota and spike-arrest policies that are
  configured per partner contract. Quotas are issued per OAuth client / consumer key based on the
  treasury management agreement. The platform is sized for 10M+ transaction events daily across
  the customer base.
notes: Per-partner numeric limits are negotiated and not publicly published. Apigee gateway controls
  cap traffic per consumer key.
sources:
  - https://hnbdevportal.huntington.com/
limits:
  - name: Treasury Management API (per partner)
    scope: oauth_client
    metric: requests_per_minute
    limit: not publicly published; negotiated per Apigee API product
    notes: Apigee quota policies enforce per-product per-minute and per-day caps.
  - name: Spike arrest
    scope: oauth_client
    metric: requests_per_second
    limit: not publicly published; Apigee spike-arrest policy
    notes: Burst protection independent of quota; smooths inbound traffic.
policies:
  - name: OAuth2 / mTLS Authentication
    description: All production calls require an OAuth2 client credentials flow plus typically mTLS
      for treasury-grade endpoints. Tokens are short-lived.
  - name: Apigee Quota Enforcement
    description: Per-consumer-key quota and spike-arrest policies enforce both burst and sustained
      ceilings. Specific values are configured per partner per API product.
  - name: 429 Throttling Response
    description: Standard Apigee 429 response with Retry-After header when quotas are exceeded.
  - name: Backoff Strategy
    description: Implement exponential backoff and honor Retry-After header. Coordinate with Huntington
      partner enablement on quota raises.
  - name: Sandbox vs Production
    description: Sandbox endpoints have separate, lower limits intended for integration testing only.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com