# Rate limiting

The iClosed.io API applies rate limits so the platform stays fast and reliable for everyone.

## Startup and Business limits

Rate limits apply **per account** and **per endpoint** (each path and HTTP method combination is counted separately). Within each **10-second** window:

| Plan | Limit per endpoint |
|  --- | --- |
| **Startup** | 20 requests |
| **Business** | 100 requests |


## MCP server (`/mcp`)

The hosted MCP entrypoint (`POST /mcp`, and SSE `POST /messages`) also applies a **per-token** sliding-window limit on top of the `/v1` per-endpoint limits. That stops an agent loop from fanning out unlimited tool calls across many different actions in a short burst.

| Default | Value |
|  --- | --- |
| **Window** | 10 seconds |
| **Max requests** | 20 (Startup-aligned) |


When exceeded, the MCP server responds with **`429 Too Many Requests`**, `Retry-After`, and standard `RateLimit-*` headers. Back off and retry.

## How limits are managed

Rate limits are **configured and enforced by the iClosed team**. They are not something you change from the API or the app yourself.

## Need higher limits?

If your integration needs a **higher or custom rate limit**, contact **[Support](https://iclosed.io/)**. The team can review your use case and adjust limits where appropriate.

## When you exceed the limit

If you send too many requests in a short period, the API may respond with **`429 Too Many Requests`**. Back off, retry with exponential delay, or reduce your request rate. For long-term increases, use Support as described above.