Rate Limiting - UQPAY Developer Docs

UQPAY applies rate limits to API requests. The limits and time windows depend on the request type and environment.

General rate limits

Request type	Endpoint	Sandbox	Production
Access Token	`POST /api/v1/connect/token`	50 requests per minute	100 requests per minute
All other authenticated requests, except the File Service endpoints below	Authenticated API endpoints	10 requests per second	20 requests per second
Upload A File	`POST /api/v1/files/upload`	5 requests per second	10 requests per second
Get File Download Links	`POST /api/v1/files/download_links`	5 requests per second	10 requests per second

Use the File Service base URL for the two file endpoints: https://files.uqpaytech.com in Sandbox and https://files.uqpay.com in Production.

Card Issuance rate limits

The following Card Issuance operations have specific limits measured over a rolling 60-second window.

Operation	Endpoint or integration	Limit per rolling 60 seconds
Create PAN Token	`POST /api/v1/issuing/cards/{id}/token`	10 requests per card within the same account, and 1,000 requests in total for this endpoint within the same account. Exceeding either limit triggers rate limiting.
Elevate Per-Transaction Limit	`POST /api/v1/issuing/cards/{id}/elevate_limit`	5 requests per card within the same account.
Secure iFrame	Sensitive card details retrieval through Secure iFrame	100 requests per IP address. Requests for different cards share this limit.

Exceeding the rate limit

When you exceed a rate limit, the API returns HTTP 429 Too Many Requests. Handle this status in your client, reduce the request rate, and retry with exponential backoff and random jitter. For rolling-window limits, allow earlier requests to fall outside the window before retrying.