Rate Limiting in Device Manager

This article explains how burst rate limiting works for the Device Manager API, how the allowed request rate is calculated, and what happens when requests exceed the allowed limit.

Use this when you are building or maintaining an integration with the Device Manager API and need to understand short-term request limits, expected 429 responses, and how the limit scales with the number of devices in scope.
 

Overview

Device Manager applies a short-term burst rate limit to API traffic to prevent a single customer or device group from creating a sudden spike in requests.

The limit is evaluated in 1-minute windows and is keyed based on the users' account. Requests above the allowed rate are rejected immediately with HTTP 429. They are not queued for later processing.
 

How the limit is calculated

The base burst allowance is 20 requests per minute.

This allowance is then scaled based on the number of devices in scope, at roughly 1 additional multiplier for every 100 devices, with a minimum scaler of 1.
 

The same pattern continues as the device count increases.
 

What happens when the limit is exceeded

When the request count for the current 1-minute window exceeds the calculated allowance, Device Manager returns HTTP 429.

• Requests above the limit are rejected immediately.
   
• Device Manager does not queue delayed requests for the next window.
   
• Additional requests can be made once the next 1-minute window begins.
   

Integrations should treat 429 as a signal to reduce request rate and retry in a controlled way.
 

Integration guidance

If you are building against the Device Manager API, design your integration so that it avoids short request spikes against a single account.

• Spread high-volume operations across time where possible.
   
• Avoid bursty retry loops after failures.
   
• Add backoff and retry handling for HTTP 429 responses.
   
• Test with realistic request patterns, especially for larger fleets.
   

This is particularly important for integrations that perform bulk actions, polling workflows, or repeated calls across large device groups.
 

Example

An integration operating on a device group with 250 devices would fall into the 201-300 range.

That device group would have a scaler of 3, giving an allowance of 60 requests per minute for each 1-minute window.
 

Related articles

• Welcome to the Device Manager API
   
• Creating API Credentials - Device Manager
   
• Device Manager Release Notes
   

Check the release notes for updates to Device Manager behaviour or integration features.