On Rate Limit determines how many requests a user, a service, or an IP address may send to a programming interface (API) within a given time window. A typical example is a limit of 10 requests per second.
Purpose
Rate limits serve three goals: security, cost control, and fairness. The limit protects servers from load peaks and attacks such as denial of service (DoS). At the same time, it controls operating costs. Furthermore, it prevents a single actor from monopolizing the system’s capacity. Providers also use quotas for other rules, such as monetization. A rate limit is suitable where users can change the pace of their requests without changing the result.
Feedback to the client
If a client exceeds the limit, the server can respond with the HTTP status code 429 (defined in RFC 6585). The response should explain the reason and can be specified in the Retry-After field, how long the client should wait. However, servers do not have to use 429. With very many requests, it may be more sensible to disconnect connections. An IETF draft (not yet a finalized standard) additionally describes the RateLimit-Policy fields for the rule and the RateLimit for the currently available quota. According to the draft, a positive remaining quota does not guarantee that the server will serve further requests.
Procedure
The token bucket fills a bucket with tokens and allows for short peaks in demand. The Fixed Window Counter counts requests within a fixed time window. Limits can be exceeded up to double the limit at the window limits. The Rolling Window works with a sliding window: it is more precise, but requires more memory.
Example SAP Business One
The editions of SAP-B1-MCP limit the number of queries per user per hour (BASIC 60, PRO 600, ENTERPRISE unlimited, as of October 2026). The Kompakt tariff of Versino Skills allows up to 50 queries per day per company, while the Unbegrenzt tariff has no daily limit.
Demarcation
A limit for the number of rows per query is not a rate limit. It limits the number of results of a single query, not the number of requests per time window. A Concurrent Request Limiter also does not limit the number of requests per time window, but the number of concurrently active requests.
Related entries: API; REST API; SAP-B1-MCP (Versino); Versino Skills; Access Token (Access Token).
Shopware 6 for SAP Business One
SAP Business One and DATEV - Synchronised
DATEV and SAP Business One Export & Import
Electronic invoices to authorities
SAP Business One Connect for carriers
