Rate limits
Per-key request limits with X-RateLimit headers, plus the per-number sending limits of the Number Shield.
Two different kinds of limits apply. Request limits protect the API; sending limits protect your WhatsApp number.
Request limits (per API key)
| Class | Limit |
|---|---|
Reads (GET) | Limit600 per minute |
| Writes (everything else) | Limit120 per minute |
Every answer tells you where you stand:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | MeaningRequests allowed in the current window. |
X-RateLimit-Remaining | MeaningRequests left in the window. |
X-RateLimit-Reset | MeaningWhen the window resets (Unix time, seconds). |
Retry-After | MeaningOn 429 (and 423): seconds to wait before retrying. |
X-Request-Id | MeaningThe id of this request — quote it to support. |
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1760353260
Retry-After: 17
{ "error": { "code": "RATE_LIMITED", "message": "Rate limit of this key reached.", "docsUrl": "https://mursilat.com/developers/v2/errors#RATE_LIMITED", "requestId": "req_…" } }Sending limits (per number)
Sends also pass the per-key and per-number limits of the public API and the Number Shield: warm-up caps per day and hour, pacing between messages to new contacts, quiet hours for campaigns. These answer 429 with a SAFETY_* code and details.retryAt, or 423 SAFETY_NUMBER_PAUSED while a number is paused.
Let Mursilat pace for you
Sending many messages one by one fights the Shield. A campaign does the pacing, retries and quiet hours for you and reports progress by webhook.