Rate limits

Every limit on the Partner API, per endpoint: how often, how many per day, how many per request, and what you get back when you hit one.

The limits protect the inventory that every CatchBack customer shares. Most are counted per API key, and a day is a UTC day, from midnight to midnight UTC. On top of them, everything under /api/ has a shared limit per IP address.

Four limits are settings on your key: the time between pack purchases, packs per day, cards per day and card spend per day. The numbers below are the defaults, and we can change any of them for your key on request: contact us if yours don’t fit your volume. The limits on a single request, on shipments and on test accounts are the same for every key.

Per endpoint

Endpoint	Limit	Set per key	When you go over
Buy packs	One request per 60 seconds	Yes (default)	429 RATE_LIMITED, with a Retry-After header
Buy packs	100 packs per UTC day	Yes (default)	429 DAILY_LIMIT_REACHED
Buy packs	Up to 10 packs per request, or the pack’s max_quantity if that is lower	No	400
Buy a card	25 cards per UTC day	Yes (default)	429 DAILY_CARD_LIMIT_REACHED
Buy a card	$50,000 of spend per UTC day, the $1 fees included	Yes (default)	429 DAILY_CARD_LIMIT_REACHED
Sell back cards	Up to 10 items per request	No	400
Create a shipment	50 shipments per UTC day	No	429 DAILY_SHIPMENT_LIMIT_REACHED
Estimate a shipment	60 estimates per minute, where one with cover_amount counts as two	No	429 RATE_LIMITED, with a Retry-After header
Estimate a shipment, Create a shipment	Up to 10 cards per request	No	400
Create a test account	5 active test accounts, 30 days each	No	409
Public card metadata	60 requests per minute per IP address; a CDN hit doesn’t count. The count is kept per server, so the exact point you’re refused can vary	No	429 RATE_LIMITED, with a Retry-After header
List a card, Change a listing’s price, Delist a card	No per-key rate limit
Every read endpoint	No per-key rate limit; page sizes are capped (see Pagination)
Everything under /api/	300 requests per minute per IP address, shared	No	See Shared limit per IP

Card buys have no per-minute limit, and sell-backs have no rate limit per key. Reads don’t either, but keys are monitored: a full catalog sync a few times an hour is fine; polling every few seconds is not. To hear about your own orders without polling, use a webhook.

Card lookups (Get a card, Find a card by cert and Card activity) are cached for up to a minute, and Price history for up to five minutes, so asking more often than that returns the same answer.

Shared limit per IP

Everything under /api/ has a shared limit of 300 requests a minute per IP address, on top of the per-key limits on this page. That covers every partner endpoint, the MCP server and Public card metadata. It counts by IP address, not by key, so several keys behind one address share it. Keep your traffic well under it. A refusal here may not look like the responses on this page, so treat any refusal as a reason to back off.

Pack purchases

• Speed: one purchase request per key every 60 seconds. One request can open several packs, so a bot that wants five packs sends one request with quantity: 5, not five requests.
• Daily ceiling: 100 packs per UTC day, counting completed orders. A request is refused whole if it would take you over: with 97 used, a request for 5 is a 429 even though 3 would fit.
• Per request: 1–10 packs of one type. List packs gives each pack’s max_quantity: 1 for the Starter, sealed mystery packs and community packs, and 5 for watch packs. More than that is a 400.

The daily ceiling is checked first, then the speed limit. A refused request charges nothing and doesn’t use up your slot for the minute. A purchase that fails after it starts hands the slot back too, so a fixable error doesn’t cost you a minute, unless we couldn’t confirm its charge: that order is held for review and keeps its slot. A retry of an order you already sent (the same Idempotency-Key) skips both checks: you can always find out what your first attempt did.

429 RATE_LIMITED

{
  "error": "Rate limited: one purchase per key every 60 seconds.",
  "code": "RATE_LIMITED",
  "retry_after_seconds": 43
}

429 DAILY_LIMIT_REACHED

{
  "error": "Daily limit reached: 100 packs per day (98 used).",
  "code": "DAILY_LIMIT_REACHED",
  "limit": 100,
  "used": 98,
  "resets_at": "2026-10-29T00:00:00.000Z"
}

Card purchases

• Cards: 25 per UTC day.
• Spend: $50,000 per UTC day: each card's price plus its $1 buyer fee.

Both count the shop and user listings together. A finished order counts what it charged. An order that is still running counts at its max_price + $1, so parallel orders can’t all pass the check and overshoot the cap. A refused order charges nothing and frees its order id, so you can send it again after resets_at.

429 DAILY_CARD_LIMIT_REACHED

{
  "error": "Daily card limit reached: 25 cards / $50000 per day.",
  "code": "DAILY_CARD_LIMIT_REACHED",
  "cards_used": 25,
  "max_cards_per_day": 25,
  "spend_used": 18240.5,
  "max_card_spend_per_day": 50000,
  "resets_at": "2026-10-29T00:00:00.000Z"
}

Shipments

• Per day: 50 shipments per key per UTC day. A shipment we refused doesn’t count, and a refused shipment charges nothing and frees its id.
• Estimates: 60 per key per minute, because each one is a live call to the carrier. One with cover_amount is two calls, so it counts as two. The count is kept per server, so the exact point you’re refused can vary.
• Per request: 1–10 cards to one address, and a max_cost of at most $10,000.

These are the same for every key. More on Shipping cards.

429 DAILY_SHIPMENT_LIMIT_REACHED

{
  "error": "Daily shipment limit reached: 50 per key per UTC day.",
  "code": "DAILY_SHIPMENT_LIMIT_REACHED",
  "limit": 50,
  "resets_at": "2026-11-03T00:00:00.000Z"
}

Which 429s send Retry-After

Code	Retry-After header	When to try again
RATE_LIMITED	Yes, the same number of seconds as retry_after_seconds	After that many seconds
DAILY_LIMIT_REACHED	No	After resets_at, the next midnight UTC
DAILY_CARD_LIMIT_REACHED	No	After resets_at, the next midnight UTC
DAILY_SHIPMENT_LIMIT_REACHED	No	After resets_at, the next midnight UTC

When we can’t count

If we can’t read your usage for today, a purchase or shipment is refused with a 503 and nothing is charged: the limit checks fail closed rather than let an order through uncounted. Retry with backoff, with the same id.

Check where you stand

Get account returns your pack usage (limits, including next_purchase_at, the earliest your next pack purchase is allowed) and your card usage (card_limits), so a bot can plan its next purchase without hitting a 429. It doesn’t count shipments.