specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Medtronic
providerId: medtronic
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Healthcare
  - Medical Devices
  - Rate Limiting
description: Medtronic's developer portal is approval-gated and does not publish numeric per-second or
  per-minute API rate limits on the public site. Limits are configured per partner / per program (e.g.
  CareLink, diabetes data platform, EHR integration) and surfaced inside the developer portal once an
  application is approved. Clinical-data integrations are additionally constrained by HIPAA / GDPR
  controls and the device's regulatory clearance.
notes: |
  No public RPS / RPM numbers documented. Set reconciled=true once a program's documented per-partner
  ceiling can be referenced.
sources:
  - https://developer.medtronic.com/
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Program-scoped API limit
    scope: program/partner
    metric: varies
    limit: 'configured per partner inside developer portal'
    applies:
      - Medtronic API
    notes: Each Medtronic developer program (CareLink, diabetes platform, EHR) sets its own per-partner
      throughput; consumers should consult their program manager.
policies:
  - name: Backoff Strategy
    description: Use exponential backoff with jitter on transient errors and honor Retry-After when
      present.
  - name: Idempotency
    description: Use unique transaction IDs for state-changing requests against clinical and device
      records to safely retry across timeouts without duplicating clinical events.
  - name: HIPAA / GDPR Controls
    description: Clinical-data integrations operate under HIPAA (US) and GDPR (EU) controls; integrations
      must respect data-minimization, consent scope, and audit obligations defined in the program's
      data-processing agreement.
  - name: Regulatory Boundary
    description: APIs that touch FDA-regulated device function sit inside the device's cleared intended
      use; integrations must not extend beyond that scope without appropriate regulatory pathway.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com