specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: SailPoint
providerId: sailpoint
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Identity Security
  - IAM
  - B2B
  - Rate Limiting
description: SailPoint Identity Security Cloud enforces a 100 requests / 10 seconds rate limit per access_token
  across V3 API calls through the API gateway. Throttled responses return HTTP 429 with a Retry-After
  header indicating seconds until the limit resets. Limits are scoped to the access token rather than
  per-tenant aggregate, so distributing across tokens is the documented scaling lever.
sources:
  - https://developer.sailpoint.com/docs/api/getting-started
headers:
  retryAfter: Retry-After
responseCodes:
  throttled: 429
limits:
  - name: V3 API gateway
    scope: access_token
    metric: requests_per_window
    limit: 100
    timeFrame: second
    notes: 100 requests per 10 seconds per access_token across V3 endpoints.
policies:
  - name: Retry-After signaling
    description: Throttled responses include a Retry-After header indicating seconds to wait before retrying.
  - name: Token-scoped throttling
    description: The 100 / 10s limit is per access_token. High-throughput integrations should mint multiple
      tokens (per integration / per service account) rather than share a single token.
  - name: Exponential backoff
    description: Clients should apply exponential backoff with jitter on 429 responses, honoring the Retry-After
      header.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com