HubSpot API 429 too many requests: what the rate limits are and how to stay under them

A 429 from the HubSpot API means your app or your account went over a rate limit. Once you're over, HubSpot returns a 429 for every call that follows, so a script that retries straight away just collects more of them. HubSpot's general limits come in two kinds. One is a burst limit per 10 seconds, and the other is a daily limit that all privately distributed apps in one account share.

The first thing to check is the body of the 429 response. Its policyName and message fields say which limit you hit. DAILY means the account's allowance for the day is gone, and it resets at midnight in the time zone set in your HubSpot account. If it points to the secondly limit instead, one app sent too many requests too quickly. HubSpot's guidelines call this the TEN_SECONDLY_ROLLING limit, and the fix is to slow that app down.

What the HubSpot API rate limits are

As of October 2026, HubSpot's API usage guidelines give these limits for legacy private apps and for apps on the new developer platform that are distributed privately. The 10-second limit applies to each app. The daily limit is shared by all of them in one account. Your highest tier on any hub decides which row applies.

The API limit increase add-on raises these. Each one adds 1,000,000 calls a day, and you can buy two at most. Legacy public apps and OAuth apps distributed through the HubSpot Marketplace work differently. Each account that installs one gets 110 requests every 10 seconds, not counting the CRM search API, and the add-on doesn't change that. Service keys follow the same limits as privately distributed apps.

Why you're getting 429 errors

One app is sending requests too fast

Loops that update records one at a time, or several workers running in parallel, hit the 10-second limit first. Check the headers HubSpot returns on each response. X-HubSpot-RateLimit-Max and X-HubSpot-RateLimit-Remaining give the limit and what's left in the window, and X-HubSpot-RateLimit-Interval-Milliseconds gives the window length. The older Secondly headers are deprecated, and the limit they describe is no longer enforced.

Several apps share the daily allowance

A sync tool, a reporting script and a few workflow actions can each look small and still drain one shared pool. X-HubSpot-RateLimit-Daily-Remaining shows what's left today, though it isn't sent on requests authorized with OAuth. In HubSpot, a super admin can see API call usage on the Other Limits page of Account & Billing settings (account limits). For a legacy private app, go to Development, then Legacy apps, open the app and use its Logs tab, which keeps 30 days of calls and filters by response code (legacy private apps). Apps on the new developer platform show usage under Development, then Monitoring, then API call usage.

The search API has a tighter limit

The CRM search endpoints allow five requests per second per account, and their responses carry none of the rate limit headers. A search returns up to 200 records per page and 10,000 results in total, and paging past 10,000 returns a 400. Scripts that search for each record before updating it run into this long before the general limit. The associations API also has stricter limits, listed in its own guide.

Workflows are calling the API

A custom code action that calls HubSpot's API uses the same limits, and a large enrollment runs that code for every record. HubSpot retries a custom code action for up to three days when a call fails with a rate limit error, or a 429 or 5XX error from axios or @hubspot/api-client, as long as the code throws the error back. Webhook calls sent by workflows don't count toward the API rate limit.

How to fix HubSpot 429 errors

1. Read policyName in the 429 body to see whether it's the daily or the 10-second limit.
2. Find the app making the calls, using the private app Logs tab or API call usage under Monitoring.
3. For the 10-second limit, throttle the app. Read the remaining header, pause before the window runs out, and after a 429 wait before you retry.
4. Move single-record calls to batch endpoints. CRM object batch endpoints, such as the contacts ones, take up to 100 records per request, so one call can replace a hundred.
5. Cache data that rarely changes, such as properties, owners and form settings, instead of fetching it on every run.
6. Replace polling with webhooks, so HubSpot tells your system about changes instead of your system asking every few minutes.
7. Queue search requests so they stay under five per second.
8. If you still reach the daily limit after this, look at the API limit increase. It helps privately distributed apps only, not legacy public apps or marketplace apps.

How to stop it happening again

Give each integration its own app, so its calls show up separately in the logs. Have your scripts record the daily remaining header and alert you when it gets low. HubSpot says error responses shouldn't be more than 5% of your daily requests, and marketplace apps have to stay under that to be certified. HubSpot's error handling page also covers 502 and 504 timeouts, which come from a large number of requests over a long period, and the 423 Locked response to fast bulk upserts, which needs a delay of at least two seconds between requests. If 401 or 403 errors show up next to your 429s, read private app token errors.

If you can't tell which app is using up the calls, or a sync needs rebuilding to use fewer of them, book a free 30-minute call.

Questions

When does the HubSpot daily API limit reset?

At midnight, based on the time zone in your HubSpot account's settings.

Will the API limit increase fix 429s from a third-party app?

Not for legacy public apps or OAuth apps distributed through the HubSpot Marketplace. They have a fixed limit of 110 requests per 10 seconds in each installed account, not counting the CRM search API, and the add-on doesn't raise it.

Do workflow webhooks count toward the limit?

No. HubSpot says webhook calls made from workflows don't count toward the API rate limit. Custom code actions that call the API do count.

Can I check today's usage through the API?

Yes, for legacy private apps. A call to GET /account-info/2026-09/api-usage/daily/private-apps returns the day's usage and the limit for all of them together.