# Rate limits and quotas

Source: https://veriport.io/docs/rate-limits (published 2026-10-24)

Two different limits: requests per second (burst protection, answered 429) and calls per calendar month (the allowance, then credits, answered 402 when both are used). Both are readable from headers on every answer.

- Per second: 1 without a key, 2 free, 5 with credits, 10 on the monthly plan. Lists go through the bulk endpoint (100 items a request, one request).
- Per month (UTC calendar month): 100 calls free; 5000 on the plan. Credits are consumed only once the allowance is used, from the pack expiring first.
- Headers on every answer: `RateLimit-Limit`, `RateLimit-Remaining`, `X-Quota-Remaining` (allowance + credits), `X-Tier`; a 429 adds `RateLimit-Reset`, `RateLimit-Policy` and `Retry-After`.
- A 429 carries `Retry-After`. A 402 says whether the free allowance or the plan’s allowance ran out and points at the pricing page.

## What counts as a call

One answered validation, one rates read (the table or one country), one IBAN check; in bulk, one per item answered. Not counted: 4xx and 5xx answers, structurally impossible VAT numbers (VIES is not called), `/me`, `/status`, `/openapi.json`.

## Where the per-second limit is enforced

On a window shared by every instance of the service, per key (per address without a key): a burst spread over several connections or regions is counted once, so the limit you read in `RateLimit-Limit` is the limit you get. Every 429 says when the window resets (`RateLimit-Reset`), which policy applied (`RateLimit-Policy`) and when to retry (`Retry-After`); the monthly quota is enforced on the database by one conditional write per charge. If your integration needs a guaranteed higher rate, write to us before load-testing.

## Why VIES calls are paced

The Commission throttles callers (`MS_MAX_CONCURRENT_REQ`, `GLOBAL_MAX_CONCURRENT_REQ`) and blocks addresses that hammer it. Our per-second limits and the bounded concurrency of the bulk endpoint keep the shared upstream usable for everyone; when VIES refuses a request anyway you get a 503 `vies_blocked` with `retryAfter`, not counted.

## Questions

### When does the monthly allowance reset?

On the first day of the month at 00:00 UTC. Credits do not reset; they expire 12 months after purchase.

## Read next

- [Authentication and tiers](https://veriport.io/docs/authentication)
- [Pricing](https://veriport.io/pricing)

## Sources

- VIES — help page: what the consultation number proves, member-state availability — https://ec.europa.eu/taxation_customs/vies/#/help (2026-10-24)