Skip to main content

Overview

The Smartbills API throttles requests using a token bucket. Every request consumes one token. Tokens refill continuously, so short bursts are absorbed and sustained load is capped.

The limits

These limits are the same for every plan. There is no per-plan or per-tier rate limiting. If you need a higher ceiling, contact [email protected] rather than assuming an upgrade will raise it.

How requests are partitioned

Each access token gets its own bucket. Two integrations using different tokens do not compete with each other, and exhausting one token’s bucket does not affect another.
Unauthenticated requests are the exception. They all share a single global bucket across every caller. Do not build anything that depends on unauthenticated throughput, because someone else’s traffic will exhaust it.

When you exceed the limit

The API responds with 429 Too Many Requests:

The Retry-After header

Retry-After gives the number of seconds until capacity is available. Honour it.
The API does not return X-RateLimit-Limit, X-RateLimit-Remaining, or X-RateLimit-Reset. If your client reads those headers to decide when to throttle, it will read undefined and never back off until it starts collecting 429s. Retry-After on a 429 is the only rate limit signal the API emits.

Backing off correctly

Because there is no remaining-quota header, the correct pattern is reactive rather than predictive: send requests, and back off when you are told to.
Add jitter even when using Retry-After. If several workers are limited at the same moment they will otherwise all retry on the same tick and collide again.

Staying under the limit

Many resources expose batch or bulk variants. Updating 200 expenses through a bulk endpoint is a handful of requests instead of 200.
Raising the page size on list endpoints reduces the number of round trips for the same data. See Pagination.
Polling for changes is the most common cause of hitting the limit. Subscribe to the events you care about and let Smartbills call you. See Webhooks.
Buckets are per access token. Separate tokens per integration keeps a noisy batch job from starving your interactive traffic.

Errors

Error codes and response shapes

Webhooks

Receive events instead of polling