← Guides

Rate limits and errors

Try it on a test key

curl -s -D - -o /dev/null "https://api.wellwardhealth.com/v1/prices?service=colonoscopy&near=00010" -H "Authorization: Bearer $WELLWARD_KEY" | grep -i ratelimit

Limits are per organization — every key in your org shares them, so creating more keys does not raise them. Test and live traffic are counted separately, and test keys have the same limits as live keys.

| Endpoints | Per second | Per day | |---|---|---| | Prices and benchmarks (/v1/prices, /v1/prices/{id}, /v1/benchmarks, MCP) | 5 | 5,000 | | /v1/search | 2 | 1,000 | | /v1/coverage | 5 | 5,000 | | POST /v1/price-requests | 2 | 500 | | Everything else | 20 | 100,000 |

On top of these, your org has a ceiling of 1,200 calls a minute across all endpoints. The per-day limits are rolling 24-hour windows, so capacity comes back gradually rather than all at once at midnight.

Price records per day. Separately from calls, we count the price records we serve your org — every price in every response, including every page. An org can be served 10,000 price records in any 24 hours; a new account (card-billed, before its first invoice is paid) 2,500. Past that, price calls return 429 until capacity returns.

Higher limits are available by arrangement.

Every response carries the binding window:

X-RateLimit-Limit: 10
X-RateLimit-Remaining: 7
X-RateLimit-Reset: 1790131561

(also sent as RateLimit-Limit / RateLimit-Remaining / RateLimit-Reset). Over a limit you get 429 with Retry-After in seconds. Back off exponentially and retry; do not retry faster than Retry-After.

Errors

Errors are RFC 9457 problem details, Content-Type: application/problem+json:

{
  "type": "https://api.wellwardhealth.com/problems/rate_limited",
  "title": "Too many requests",
  "status": 429,
  "detail": "Over 10 requests/second. Retry in 1s.",
  "instance": "/v1/prices",
  "request_id": "01M362F3EC2V769X0KT84NPE8C"
}

Branch on the last segment of type. The full list is in the Problem schema of the API reference. Every response — success or error — carries X-Request-Id; quote it if you contact us.

POST bodies are limited to 16 KB, and a field the endpoint does not document is refused with 400 rather than ignored — we never accept information about the people you serve.

API reference · Dashboard · Questions: hello@wellwardhealth.com