Rate limiting

Tesouro API uses rate limiting to protect Tesouro against spikes of incoming traffic that can put our systems at risk. These limits help us ensure that Tesouro remains stable and usable for everyone. By default, Tesouro API allows 30 requests per second per partner client ID for most API calls, which should be enough for most high-traffic applications. We evaluate the number of requests sent to an API from every API client and throttle them if they surpass the allowed amount.

Depending on our requirements, we might change this limit or introduce different limits on some API calls, which result in highly intensive operations loading our systems. Also, we might have lower numbers allowed for our Sandbox accounts, compared to the Production environment.If the current rate limiting levels are not satisfactory for your integration, please contact your Account Manager at Tesouro to request an increased rate limit.

To avoid your systems becoming unavailable, we strongly recommend that you build custom logic handling rate limiting quotas provided by Tesouro. Thus, for every API request that does not exceed currently available rate limits, you receive a response with the following HTTP headers:

HTTP header	Description
`RateLimit-Limit`	The number of requests allowed per second. Same as `X-RateLimit-Limit-Second`.
`RateLimit-Remaining`	The number of available requests remaining in the current second. Same as `X-RateLimit-Remaining-Second`.
`RateLimit-Reset`	The time remaining, in seconds, until the rate limit quota is reset. Usually 1 second.
`X-RateLimit-Limit-Second`	The number of requests allowed per second. Same as `RateLimit-Limit`.
`X-RateLimit-Remaining-Second`	The number of available requests remaining in the current second. Same as `RateLimit-Remaining`.

If you surpassed the rate limit quota, you will receive a 429 Too Many Requests error indicating that you have sent too many requests within the quota period. If this happens, you will receive a Retry-After header with a value indicating how many seconds you need to wait before sending another request. Example:

HTTP/1.1 429 Too Many Requests
Date: Thu, 07 Sep 2023 12:51:32 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 41
Connection: keep-alive
RateLimit-Reset: 1
Retry-After: 1
RateLimit-Limit: 30
RateLimit-Remaining: 0
X-RateLimit-Limit-Second: 30
X-RateLimit-Remaining-Second: 0

{
  "message": "API rate limit exceeded"
}

Getting started

Authentication

Roles & permissions

Manage organizations

Common objects

Accounts payable

Accounts receivable

Expense management

Payments

Advanced

Accounting integrations