> ## Documentation Index
> Fetch the complete documentation index at: https://docs.teamcaredental.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limits and Retry Handling for Vendors

> TeamCare enforces per-location rate limits of 15 requests/minute and 10 token requests/minute per IP. Learn how to handle 429 responses correctly.

TeamCare APIs apply rate limits to protect system stability and ensure fair access. Limits are enforced on a per-location basis for resource endpoints and per IP for authentication. You must handle rate limit responses correctly to maintain a reliable integration.

## Rate limits

| Scope          | Limit                       | Applies to                                 |
| -------------- | --------------------------- | ------------------------------------------ |
| Per location   | 15 requests / minute        | All location-scoped endpoints combined     |
| Token endpoint | 10 requests / minute per IP | Authentication requests to get a JWT token |

Each location has its own independent budget. The per-location limit is also per API credential, so two different credentials accessing the same location each have their own 15-request budget.

## How rate limiting works

Rate limits use fixed 60-second windows. Rejected requests (HTTP 429) still count toward the current window. If you exceed a limit, subsequent requests in that window will continue to receive 429 responses.

## 429 response contract

When you exceed a rate limit, the API returns a `429 Too Many Requests` response with a `Retry-After` header.

```http theme={null}
HTTP/1.1 429 Too Many Requests
Retry-After: 37

{"error": "Rate limit exceeded"}
```

The `Retry-After` value is an integer between 1 and 60, representing the number of seconds you must wait before making another request.

## Required client behavior

* You **must** wait the number of seconds specified in the `Retry-After` header before retrying.
* You **must** cache your JWT token for the full 6-hour lifetime and not call the token endpoint for every request.
* You **should** keep your sustained request rate at or below 15 requests per minute per location.
* You **should** iterate round-robin across locations when syncing data from multiple locations to spread load evenly.

## Reference implementation (Python)

```python theme={null}
import time
import requests


def vendor_get(session, url, headers, max_attempts=3):
    for attempt in range(max_attempts):
        response = session.get(url, headers=headers)
        if response.status_code != 429:
            return response
        wait = int(response.headers.get("Retry-After", 60))
        time.sleep(wait + 1)
    raise RuntimeError("rate limited after %d attempts" % max_attempts)
```

<Tip>
  When syncing multiple locations, iterate through them in round-robin order to stay within each location's independent 15-request-per-minute budget.
</Tip>