Rate limits and quotas

Two different limits: requests per second (burst protection, answered 429) and calls per calendar month (the allowance, then credits, answered 402 when both are used). Both are readable from headers on every answer.

What counts as a call

One answered validation, one rates read (the table or one country), one IBAN check; in bulk, one per item answered. Not counted: 4xx and 5xx answers, structurally impossible VAT numbers (VIES is not called), /me, /status, /openapi.json.

Where the per-second limit is enforced

On a window shared by every instance of the service, per key (per address without a key): a burst spread over several connections or regions is counted once, so the limit you read in RateLimit-Limit is the limit you get. Every 429 says when the window resets (RateLimit-Reset), which policy applied (RateLimit-Policy) and when to retry (Retry-After); the monthly quota is enforced on the database by one conditional write per charge. If your integration needs a guaranteed higher rate, write to us before load-testing.

Why VIES calls are paced

The Commission throttles callers (MS_MAX_CONCURRENT_REQ, GLOBAL_MAX_CONCURRENT_REQ) and blocks addresses that hammer it. Our per-second limits and the bounded concurrency of the bulk endpoint keep the shared upstream usable for everyone; when VIES refuses a request anyway you get a 503 vies_blocked with retryAfter, not counted.

Questions

When does the monthly allowance reset?
On the first day of the month at 00:00 UTC. Credits do not reset; they expire 12 months after purchase.

Sources