Rate limits
Applied per API key. Every response carries your current position.
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 597
X-RateLimit-Reset: 1755081105| Plan | Per minute | Per day |
|---|---|---|
Sandbox (sumu_test_ keys) | 120 | 5,000 |
Standard (sumu_live_ keys) | 600 | 100,000 |
There's no burst allowance — these are fixed one-minute and one-day windows, counted per key, not a token bucket. A window can technically let through up to roughly double the limit right at its boundary; that's a deliberate tradeoff for not running a second piece of rate-limiting infrastructure, not a feature to plan a burst around.
Exceeding a limit returns 429 with Retry-After in seconds. Back off exponentially rather than
retrying immediately. Every authenticated request counts against the per-minute window, including
/documents/validate and GET requests — there's no separate, cheaper category today.
Limits apply per API key — on the Platform track, that's shared across every taxpayer you've onboarded, not per taxpayer.
Bulk sending and the reporting deadline
Oman requires tax reporting within 15 minutes of issuing a B2B invoice. If you submit a large batch — month-end runs are the usual case — spread it over the hour rather than sending it in one burst, so every document is reported inside its window. Talk to SUMU before a run above 10,000 documents.