API Fair Use Policy

Applies to api.pointofrental.com, all /v1 endpoints

Point of Rental publishes rate limits so that you can build against a known ceiling. This document defines the limits, how they are counted, and what happens when you exceed them.

Topics Included in This Article

• Purpose

• Scope

• Fair use principles

• Rate limits

• How limits are counted

• What happens when you exceed a limit

• Permitted and prohibited use

• Policy enforcement

• Requesting a higher limit

Purpose

This policy defines how much traffic an integration may generate against Point of Rental APIs, how that traffic is measured, and what happens when it exceeds the published limits. It applies to every customer and partner on the platform.

API capacity is shared. Limits keep one integration's volume from affecting response times for everyone else.

Scope

This policy covers all /v1 endpoints on api.pointofrental.com, accessed by customers, partners, or third-party developers. It applies to integrations built by customers and to integrations built by certified partners on a customer's behalf.

Point of Rental operates other interfaces, including the Consumer Portal API and product-specific APIs. Sections 3, 6 and 7 apply to those interfaces. Their rate limits are published in their own technical documentation and differ from the figures in section 4.

This policy is a technical and operational standard. It does not replace or amend your subscription agreement, API terms and conditions, or data processing terms.

Fair use principles

Four expectations apply to every integration.

• Request only what you need. Use incremental filters, cursors, and the largest page size an endpoint offers rather than re-reading whole datasets.
   

• Prefer events to polling. Where a change is available as a webhook, subscribe to it. Webhook deliveries do not count against these limits.
   

• Reuse credentials. Request a token once and use it for its full lifetime. Re-authenticating on each call multiplies your request count several times over and counts against the credential endpoint limit in section 4.
   

• Spread scheduled work. Offset recurring jobs from the top of the hour and distribute them across the window rather than issuing everything at once.

Rate limits

Design target is the rate Point of Rental commits to serving without throttling. Enforced is where requests receive 429. Limits apply to all endpoints combined unless a specific endpoint states otherwise.

All limits apply simultaneously. The first ceiling you reach is the one that throttles you.

How limits are counted

Requests pass through two layers. Either can return a 429, and both return the response format in section 6.

Both layers are always active. A request may satisfy one and be rejected by the other.

Three counting rules to design around

• Scaling out does not raise the per-key ceiling. Each additional server or egress address receives its own per-source budget, but the per-key aggregate applies across all of them.
   

• Failed authentication counts against the source address. A request with a missing, expired, or invalid credential cannot be attributed to a key, so it counts against the address it came from, which is shared with everything else behind that address.
   

• Browser preflights count. OPTIONS preflight requests count against your limit. Set a long Access-Control-Max-Age so that the browser caches the preflight instead of repeating it before every request.

What happens when you exceed a limit

Requests over an enforced ceiling return 429 Too Many Requests and are not processed. Nothing is deleted, disabled, or billed differently. Exceeding a rate limit is a technical event, not a contractual one, and carries no account consequence on its own.

HTTP/1.1 429 Too Many Requests

Retry-After: 12

X-RateLimit-Limit: 2000

X-RateLimit-Remaining: 0

X-RateLimit-Reset: 1755712800

Content-Type: application/json



{

  "error": "rate_limit_exceeded",

  "message": "Request rate exceeded 2000 requests per minute.",

  "retry_after": 12

}

Permitted and prohibited use

Your data is yours

This section governs access to the API. It does not govern what you do with your own data once you have retrieved it. Analytics, reporting, warehousing, and sending your data to other systems you use are all normal use of the API.

The limits in section 4 govern volume. The following are prohibited regardless of volume and are handled under section 8.

• Sharing, reselling, or sublicensing API credentials or API access to a third party.

• Providing Point of Rental API access as a service to businesses that are not Point of Rental customers.

• Using the API to build or operate a product that competes with Point of Rental.

• Circumventing rate limits, including rotating IP addresses or API keys, or distributing load across multiple accounts to exceed a single account's ceiling.

• Automated credential testing, credential stuffing, or high-volume authentication attempts.

• Probing for or exploiting security vulnerabilities, other than through a disclosure process agreed with Point of Rental in advance.

• Any use that materially degrades service availability or performance for other customers.

Examples

Neither list is exhaustive. If your use case is not covered, ask.

Policy enforcement

Automated throttling under section 6 needs no intervention from either side. This section applies to prohibited uses under section 7, and to sustained overage that throttling has not resolved. The response is graduated.

• Notify. We contact the account's technical contact and API key owner with the endpoints, times, and volumes observed, and the change required.
   

• Engage. Where the cause is an integration design issue, we agree a remediation plan and date with you or your integration partner.
   

• Restrict. Where a prohibited use is confirmed, or agreed remediation does not happen, we may reduce the affected key's limits or suspend it. Suspension for cause is a commercial decision taken with the account owner, not an automated action.
   

Where an integration is actively degrading service for other customers, we may apply an immediate restriction and contact the account owner directly afterward.

Requesting a higher limit

Limits are set per key and can be raised. Contact api-support@pointofrental.com or your account manager with:
 

• The API key or integration name, and the endpoints involved.
   

• The peak and sustained request rate you need, in requests per minute.
   

• Whether the load is continuous or scheduled, and if scheduled, when and for how long.
   

• What the integration does with the data, and why the volume is necessary.
   

• What you have already done to reduce it: caching, incremental sync, batching.