specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Medpace Holdings
providerId: medpace-holdings
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Clinical Research
  - CRO
  - Biotech
  - Rate Limiting
description: Medpace does not publish API rate limits. Sponsor-facing systems (ClinTrak EDC, IRT, eTMF)
  are accessed by study staff under role-based access control; programmatic integration with sponsor
  data warehouses (e.g. CDISC ODM / Define-XML exports, SAS transport, FHIR for source data verification)
  is governed by the study contract and the system's validated production controls (21 CFR Part 11,
  GDPR / HIPAA).
notes: |
  No public rate-limit documentation. Limits are governed per study and per validated system rather
  than by a developer-facing throttle.
sources:
  - https://www.medpace.com/
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Study system access
    scope: study
    metric: varies
    limit: 'governed by study contract & validated system controls'
    applies:
      - Medpace Holdings API
    notes: Access to ClinTrak EDC, IRT, eTMF and related systems is granted to qualified study staff and
      authorized sponsor users; programmatic limits live in the validated system's specification.
policies:
  - name: Backoff Strategy
    description: Use exponential backoff with jitter on transient errors and honor Retry-After when
      present.
  - name: 21 CFR Part 11 Audit Trail
    description: All access and modifications to GxP data must be captured in the validated system's
      audit trail; integrations must avoid bypassing identity / role controls.
  - name: Validated System Controls
    description: Throughput and concurrency obligations are part of each system's specification and
      validated change control. Increasing throughput requires assessment / requalification.
  - name: Data Privacy Boundaries
    description: GDPR (EU) and HIPAA (US) constraints govern subject-level data access; integrations
      must respect study-level data residency and pseudonymization rules.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com