IBM Verify SaaS API rate limits and quotas

Rate limits and quotas protect the stability of your system by controlling the number of requests that a client can make in a specified period of time.

Rate limits are designed to prevent short-term overloads or crashes when usage spikes. The suspension is temporary and resets quickly. Quotas control overall usage and reset according to your plan.

Table 1. Rate limits and quotas

API Call/Feature/Others	Rate limit	Runbook/configuration	Comments
Bulk Retry API	1 request every 30 seconds	Environment-wide	1–200 failed requests per retry
Create Dynamic Group	Trial: 5; Paid: 100	max.dynamicgroup.count	Per-tenant configurable
Device Flow (RFC 8628)	Configurable polling interval for the device flow grant type. The range is 2 to 3600 seconds.	It is configured by the tenant admin.	See the “Device flow polling interval” configuration in Configuring OIDC application general settings.
Display Operational Reports in Admin Console	50 User Compliance and 50 User Entitlement reports every 15 minutes	Tenant Portal	reporting.user_compliance.limit=50; reporting.user_entitlement.limit=50
Download CSV File (Audit and Status Reports)	50 downloads every 5 minutes	Tenant Portal	reporting.zip.file.download.request.rate.limit=50
Email OTP MFA Method	30 requests per 5 minutes	Environment-wide	Per tenant and enrollment ID
Flow Designer (Trial Tenants)	Maximum 10 flows per tenant	Contact IBM Sales Representative or IBM Contact	IBM Verify trial subscriptions allow the creation of up to 10 flows in the Flow Designer. The maximum number of flows for a trial tenant can be configured by using the property flow.max.limit. To increase this limit beyond the default value, contact your IBM Sales representative or IBM support contact.
Generate CSV Download of Audit Reports	3 audit reports every 15 minutes; 100 total per tenant every 15 minutes	Tenant Portal	reporting.tenant.rate_limit=100; reporting.time.period=900; reporting.csv.audit.quota.limit=3
Generate CSV Download of Status Reports	3 status reports every 15 minutes	Tenant Portal	reporting.csv.status.quota.limit=3
Initiate a forgot password request	2 requests per 30 minutes	N/A	Per tenant and username combination
Initiate a forgot username request	IP address / Maximum of 10 requests per hour, Tenant / Maximum of 100 requests per hour, Tenant + Attribute values / Maximum of 2 requests per hour	N/A	IP address and tenant level rate limits
Refresh Active OTP, Username Search, Check Attribute Uniqueness, Password Intelligence Validation APIs	60 requests per 60 seconds	Environment-wide	See profile-backend config
Send Email Message	Recipient: 150/300s; Tenant: 600/600s	notification.email.limit	Trial-limited; paid tenants unlimited (-1)
Send Notifications to Notification Service	24 requests per 60 seconds	Environment-wide	See service config
Send SMS Message	Recipient: 10/600s; Tenant: 600/600s	notification.sms.limit	Trial-limited; paid tenants unlimited (-1)
Send Voice OTP Message	Recipient: 5/600s; Tenant: 600/600s	notification.voice.limit	Trial-limited; paid tenants unlimited (-1)
SMS OTP MFA Method	10 requests per 5 minutes	Environment-wide	Per tenant and enrollment ID
TOTP MFA Method	6 requests per 60 seconds	Environment-wide	Per tenant and enrollment ID
Validate a password	IP address / 100000 requests per hour	Not applicable	IP address rate limited
Voice OTP MFA Method	10 requests per 5 minutes	Environment-wide	Per tenant and enrollment ID
Workflow Start API and Resume API	Flow Controls	Not applicable	Loops in a flow : In certain business scenarios, the same set of tasks can run in a loop rather than sequentially. If a task exceeds the maximum allowed number of runs, defined by flows.max.iterations, the flow ends with a catastrophic error. The maximum number of iterations for a looping flow can be configured by using the property flows.max.iterations. To increase this limit beyond the default value, contact your IBM Sales representative or IBM support contact.