What This Extension Adds #
Core DDLS has no built-in API rate limiting. DMSI Advanced API introduces a tier-based rate limiting system to protect your API from abuse and ensure fair usage across all integrations.
DMSI Advanced API enforces rate limits on all authenticated and unauthenticated API requests. Limits are applied using a fixed-window with automatic reset algorithm and are tracked per identity: API key, JWT user, OAuth token, or IP address (for unauthenticated requests).
How Rate Limiting Works #
Each identity is subject to two limits that operate simultaneously:
- Requests per hour — the sustained throughput limit over a rolling 60-minute window
- Burst limit — the maximum number of requests allowed in a short burst window
When either limit is exceeded, the API returns HTTP 429 Too Many Requests.
Rate Limit Identifiers #
Limits are tracked using the following identifier formats depending on the authentication method used:
| Authentication Method | Identifier Format |
|---|---|
| API Key | apikey:{key_id} |
| JWT Token | jwt:{user_id} |
| OAuth Token | oauth:{token_id} |
| Unauthenticated | ip:{addr} |
Authentication Endpoint Limits #
Authentication endpoints have a stricter, separate rate limit: 10 requests per minute per IP address. This limit applies regardless of tier and is enforced independently of the general API limits.
Sandbox Mode #
When sandbox mode is active, all API requests bypass the rate limiter entirely. Sandbox requests are unlimited and do not consume quota from any tier.