Rate Limits

Current Limits

EmBoux currently does not enforce rate limiting at the API level. The API is designed for infrastructure provisioning, not high-frequency access patterns.

Typical usage patterns:

Operation	Expected Frequency
Create domain	Once per customer onboarding
Create mailbox	A few per domain setup
Create alias	A few per mailbox
Quota updates	On plan change
Suspend/activate	On payment events

Recommendations

Even without enforced rate limits, follow these best practices:

1. Don’t poll — Use webhooks or Odoo crons for sync, not polling loops
2. Batch where possible — If creating multiple resources, do them sequentially without artificial delays
3. Set reasonable timeouts — We recommend 10-15 seconds per request
4. Handle errors gracefully — Retry 500 errors with exponential backoff (1s, 2s, 4s)

Future Rate Limits

When rate limiting is introduced, it will follow standard HTTP conventions:

• 429 Too Many Requests status code
• Retry-After header with seconds to wait
• Per-key limits based on plan tier

We’ll announce changes with at least 30 days notice.

WAF Protection

The API sits behind a Web Application Firewall. To avoid being blocked:

• Set a proper User-Agent header (e.g., MyApp/1.0 or Odoo/19.0 (EmBoux Core Sync))
• Don’t send malformed or extremely large payloads
• Don’t make requests from known-bad IP ranges