Every numeric limit of the REST API and the MCP server, in one place. Each row links to the guide that explains it.
Paging and queries
| Limit | Value | Explained in |
|---|---|---|
per_page | 25 by default, at most 100. At most 25 when the request includes a to-many path. | Pagination |
page | 1 to 1000 | Pagination |
sort | At most 3 keys | Filtering and sorting |
Values in an [in] filter | At most 100 | Filtering and sorting |
q | At most 255 characters | Filtering and sorting |
include | At most 5 paths, each a single name: no nesting | Views and includes |
| Rows in a to-many include | At most 25, or 50 for tags, then the list is truncated | Views and includes |
Request headers
| Limit | Value | Explained in |
|---|---|---|
X-Request-Id | 1 to 64 characters: letters, digits, _ and - | Headers and versioning |
Idempotency-Key | At most 255 characters | Idempotency |
Stored response for an Idempotency-Key | Replayed for 24 hours | Idempotency |
| A request in progress holds its key for | At most 120 seconds | Idempotency |
Rate limits
| Limit | Value | Explained in |
|---|---|---|
| Per token | 600 read units and 120 write units per minute | Rate limits |
| Per organisation | 3000 read units and 600 write units per minute | Rate limits |
| Per IP address, before the token is checked | 600 requests per minute per IP address and host, 1200 per minute per IP address | Rate limits |
Tokens and OAuth
| Limit | Value | Explained in |
|---|---|---|
| Personal access tokens | 10 live tokens per user | API tokens |
| Token expiry | 90 days by default, at most 12 months | API tokens |
| OAuth access token | Valid for 1 hour | Sign in with OAuth |
| OAuth refresh token | Valid for 30 days | Sign in with OAuth |
| App registration | 5 per minute per IP address, 30 per minute per organisation | Sign in with OAuth |
| Token endpoint | 120 requests per minute per organisation and IP address | Sign in with OAuth |
| OAuth discovery and revocation | 30 requests per minute per organisation and IP address | Sign in with OAuth |
File uploads
| Limit | Value | Explained in |
|---|---|---|
| File size | 10 MB (10,485,760 bytes) | Files: upload and download |
| Open upload tickets | 10 per user | Files: upload and download |
| Ticket validity | 30 minutes | Files: upload and download |
| Uploads in flight | 3 at once per token | Files: upload and download |
| Upload requests | 20 per minute per token | Files: upload and download |
| Transfer time | Stops after 30 seconds without data, or 120 seconds in total | Files: upload and download |
| Ticket retention | 24 hours after the file is registered; 7 days for an expired or revoked ticket | Files: upload and download |
MCP
| Limit | Value | Explained in |
|---|---|---|
| Requests | 60 per minute per user, counting every MCP request | Tools |
| Answer size | About 30,000 characters (the limit counts bytes of the JSON answer); anything cut is listed in meta.mcp_truncated | Tools |
Path in api_read and api_write | At most 256 characters | Tools |
Query in api_read and api_write | At most 60 parameters, nested at most 3 levels | Tools |
Data and caching
| Limit | Value | Explained in |
|---|---|---|
| Event dates | start at most 5 years in the past, end at most 5 years ahead | Create an event |
| Discovery response | Your client may cache it for 5 minutes: Cache-Control: | Discovery |
| Configuration reads, such as labels and work types | Your client may cache them for 1 minute: Cache-Control: | Rate limits |