Skip to main content
API rate limits control how many requests or actions you can perform within a minute or hour. When an allowance is exhausted, wait before retrying. Resource limits control the size, contents, and lifetime of business records. Waiting does not increase these limits: correct the data, reduce the batch, or free capacity as described below. The API reference also lists limits beside the affected fields.

​
API rate limits

Rate limits keep polling, bulk imports, and downloads within the capacity available to a company or Partner. A request must fit every applicable allowance, so having capacity for one operation does not bypass a shared company or credential limit. Downloads include claim, message, answer, rental-agreement and title documents, mandate documents, history and client-request attachments, and statements. Partner requests on behalf of a company share that company’s download allowance. The two hourly allowances are checked before an operation starts and charged only after a qualifying success: a 200 download or a 202 accepted test event or redelivery counts, while a 404 poll of a document that is still processing, a HEAD, or a rejected request does not. In-flight work does not reserve capacity or appear in the usage response, so closely concurrent successes can all pass the pre-check; do not treat the allowance as an in-flight concurrency ceiling. Once the stored allowance is exhausted, later requests answer 429 before the operation runs. Downloads negotiate on Accept: */*, application/octet-stream, application/pdf, image/*, and application/json are served, anything else is 406 not_acceptable; an object missing from storage is 404, a storage fault 503 service_unavailable with Retry-After. The Mahnservice and Case APIs share the per-token and per-company 600-per-minute allowances. Every write additionally charges endpoint:<basename>.<action> at 120 per minute. Mahnservice’s payments and documents routes serve reads and writes on one path: only POST charges endpoint:mahnservice-invoices.documents or endpoint:mahnservice-invoices.payments; GET charges only the shared principal allowances. The Mahnservice API has no hourly expensive-operation allowances and no usage endpoint. Enforcement: an exhausted activity allowance returns 429 throttled. Wait at least the number of seconds in Retry-After before retrying. There are no X-RateLimit-* response headers. Read Case usage or Partner usage to see capacity used, remaining capacity, and reset times. Usage and info are ordinary reads: they consume principal capacity and can return 429. Usage includes its own request in the returned used count. The hourly counters are named expensive:webhook-delivery, expensive:document-download, mail:company-create, and mail:membership-create where applicable. See Errors and safe retries for idempotency and retry handling.

​
Company creation and invitations

Company creation and membership invitations have additional hourly rate limits, shared by all credentials belonging to the same Partner: For the company-creation and membership-addition allowances, only a successful command consumes capacity; rejected or failed requests and idempotent replays do not. A request that would exceed either allowance returns 429 throttled with Retry-After and is rejected as a whole: no company or membership is created and no mail is sent. For example, inviting five users during company creation requires one available company creation and five membership additions.
On the Case Management API, a client IP may make at most 240 failed authentication attempts per minute. Missing, unknown, suspended, or wrong-environment credentials returning 401 count. Valid-key company-context failures (missing, malformed, foreign, or revoked context returning 400 or 404) do not count.Once exhausted, the guard returns 429 throttled with Retry-After. Once tripped, the guard covers every authenticated Case resource route, including GET /v2/usage/ and GET /v2/info/.A temporarily unreachable credential store instead returns 503 service_unavailable with Retry-After. Follow the indicated delay and retry commands with the same Idempotency-Key.

​
Resource limits

A resource limit applies to the complete record, even when you build it over several requests. A per-command limit applies only to the data sent together in one request. These limits are independent of the rate limits above.

​
Orders and claims

An order groups the claims you want paywise to collect from a debtor. These limits apply to invoice, rental, and titled orders where the field is available. Enforcement: oversized arrays and text return 400 validation_error. Adding a claim to an order that already has 50 claims also returns 400; sending claims one at a time does not bypass the limit. The API rejects the command instead of keeping only the first entries or shortening your text. When a PATCH replaces a collection, the replacement must fit the same limit.

​
Unfinished drafts

An API-created draft expires after 90 days without a change. The order’s expires_at field gives the deadline. A draft mutation refreshes it; reads and PATCH requests that leave the stored values unchanged do not. After the deadline, the order is shown as expired and accepts no further change: every write and finalize answer 409 order_expired, and nothing refreshes the deadline. The daily cleanup deletes the draft and its owned data, preserves reusable debtor records, and emits order.expired; subsequent reads return 404. Finalized orders and portal-created orders do not have this expiry. See the order lifecycle.

​
Debtor information

A debtor is a reusable record. The following limits apply both when you create one inside an order and when you use the debtor endpoints directly. Enforcement: an oversized collection returns 400 validation_error. On updates, supplied arrays replace their collection, so the limit applies to the full replacement, including retained entries. Omission preserves a collection; [] clears it where allowed. Other requirements, such as a single primary address, still apply.

​
Documents and attachments

Case documents provide evidence for claims, rental agreements, and enforceable titles, or accompany messages and answers to client requests. For example, six 9 MiB files each fit the individual file limit, but their combined 54 MiB exceeds the inline command limit. Send fewer files per command through the parent resource’s document endpoint. The 20-document limit is a submission limit, not a lifetime allowance for an order. Enforcement: the Case Management API validates document counts, decoded sizes, and PDF pages before accepting the command; the count is checked before any file is decoded. Violations return 400; file errors name file or base64, including a nested document path for inline uploads. A PDF above 100 pages uses page_limit_exceeded. Correct the files or split the batch before retrying. The bytes are stored during the request: if document storage is briefly unavailable, the command answers 503 service_unavailable with Retry-After, creates nothing, and releases its Idempotency-Key, so retry it with the same key. Accepted documents still undergo asynchronous scanning and processing; check status and failure_reason before relying on their availability. Mahnservice invoices accept one PDF per invoice, with the same 10 MiB file and 100-page PDF ceilings. Uploading again replaces the current PDF while the invoice is held. Oversized, encrypted, corrupt, or non-PDF files and PDFs above 100 pages are rejected during upload with the same 400 codes as the Case Management API (encrypted, page_limit_exceeded, corrupt, unsupported); a storage fault during the upload is 503 service_unavailable; processing failures appear as status: failed. An attached document must reach ready before the invoice can be released.

​
Companies and memberships

The Partner API lets you onboard companies and invite their users. Enforcement: oversized lists return 400 validation_error. Notification recipient and legal representative limits also apply to replacement lists on updates. The initial users limit applies to company creation, not to the company’s total number of memberships.

​
Webhook subscriptions

You can register 20 webhook endpoints per company in the Case Management API, or 20 per Partner in the Partner API. Enabled and disabled endpoints both count. Enforcement: creating a 21st endpoint returns 409 webhook_limit_reached. Delete an endpoint you no longer need before creating another; disabling it does not free capacity. The separate webhook delivery rate limit controls how often you can test or manually redeliver a webhook.

​
Request size and pagination

These technical safeguards apply across all three APIs. Base64 encoding increases the transmitted size: 50 MiB of decoded documents becomes about 67 MiB before the surrounding JSON. Both the decoded-document limit and request-body limit must be respected. Use pagination to work through larger result sets.