Rate Limits

If you receive a 429 RATE_LIMIT error, you have exceeded the allowed number of requests for a given endpoint. bunq enforces per-endpoint rate limits — the window and maximum request count differ depending on what the endpoint does and how sensitive it is.

How rate limits work

Every request is tracked per device (identified by your API key, session, or IP address). The system counts requests to a specific endpoint within a rolling time window. When you exceed the limit you receive an HTTP 429 response with a message indicating the exact limit:

"Too many requests. You can do a maximum of X calls per Y seconds to this endpoint."

Rate limits by endpoint category

Endpoint category	Example endpoints	Limit
Payment processing	Card lookups	up to 1,000 requests / second
Standard data endpoints	User info, account info, events	70–140 requests / 30 seconds
Security-sensitive actions	Alias registration	3 requests / 60 seconds
Setup / installation endpoints	Device installation	as low as 10 requests / day

The exact limit for an endpoint is returned in the 429 error message itself. Build your retry logic around that value rather than assuming a fixed global limit.

Callback limits

A maximum of 2 callback URLs per notification category is allowed.

Handling 429 errors

• Implement client-side rate limiting to stay below the per-endpoint limits.

• When you receive a 429, back off and retry using exponential backoff (see Querying Payments).

• Do not hammer the endpoint — repeated 429s will extend your backoff window.