0Bit public documentation
Rate limits
The request limits enforced on public Gate partner routes.
Gate applies three concurrent windows by client tracker: 10 requests per 10 seconds, 60 per minute, and 300 per hour by default. A route-specific short-window override replaces only the first of those windows.
Public route limits
| Short-window limit | Operations |
|---|---|
| 10 per minute | POST /gate_sessions, POST /dashboard/webhook-secret/rotate, POST /webhooks/test |
| 30 per minute | POST /quotes/preview, POST /quotes, POST /rails/pay_ins, POST /rails/pay_outs, POST /embed/bootstrap, POST /gate_sessions/{id}/cancel, customer writes, PATCH /branding, webhook replay |
| 60 per minute | Session reads, capabilities, transaction reads, signed-quote and rail reads, customer reads, GET /branding, dashboard volume, dashboard usage |
| Default windows | GET/PATCH /dashboard/webhook-settings, GET /dashboard/webhook-deliveries |
All routes remain subject to the global 300-per-hour window. Limits protect the service and are not a throughput commitment.
A rejected request returns HTTP 429. Retry after a delay with randomized exponential backoff. Preserve the same idempotency key when retrying an operation that accepts Idempotency-Key.
const delay = Math.min(30_000, 500 * 2 ** attempt) + Math.random() * 250;
await new Promise(resolve => setTimeout(resolve, delay));
Avoid synchronized polling. Prefer signed webhooks for lifecycle changes, cache capability responses briefly, and stop retrying an unchanged request after 400, 401, or 403.