Rate Limits and Idempotency

Rate limits

Tadbeer limits requests by authenticated user when a bearer token is present, otherwise by IP address. Limits are evaluated per method and route.

Surface	Default	Window	Notes
Public and user API	5 requests	1 minute	Controlled by `AUTH_RATE_LIMIT_PER_MINUTE`.
Admin API	60 requests	1 minute	Controlled by `ADMIN_RATE_LIMIT_PER_MINUTE`.

When a limit is exceeded, the API returns:

http

HTTP/1.1 429 Too Many Requests
Content-Type: application/json

{ "error": "rate limit exceeded" }

Idempotency

POST and PATCH resource writes support Idempotency-Key. Tadbeer stores the response for 24 hours in Redis and replays it when the same key, route, method, and body fingerprint are used again.

bash

curl -sS https://api.roundworld.sy/v1/businesses/$BUSINESS_ID/customers \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: customer-import-row-492' \
  -d '{"name":"Acme Trading","email":"ops@example.com"}'

Reusing a key with a different request body returns a conflict error. Use stable keys generated by your job runner, payment provider event ID, import row ID, or upstream operation ID.

Rate Limits and Idempotency ​

Rate limits ​

Idempotency ​

Rate Limits and Idempotency

Rate limits

Idempotency