// developers · limits
Limits you can read, and a log of every call.
120 requests a minute per credential by default, stated on every refusal. Every call, including tools/list, lands in an audit log you can read back through the API.
// rate limits
Back off for the seconds you are told.
The limit counts per credential per minute, and a store can be given a different one. It is not part of the versioned contract, so read it from the response rather than hard-coding it.
A 429 carries Retry-After and the RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, and its body names the limit and the wait.
POST /api/v1/tools/get_orders → HTTP/1.1 429 Too Many Requests
Retry-After: 17
RateLimit-Limit: 120
RateLimit-Remaining: 0
RateLimit-Reset: 17
{ "error": "rate_limited", "limit": 120, "retry_after_seconds": 17, … }// every bound
The numbers, in one place.
- Requests per minute
- 120 per credential (default)
- Webhook subscriptions
- 20 per store
- Webhook delivery
- 6 attempts, 10 seconds timeout, disabled after 20 consecutive failures
- Partner sources
- 5 per store, 500 calls a day each by default
- Access token
- 1 hour
- Refresh token
- 30 days
- Audit page size
- 50 by default, 200 at most
// audit
Every call is recorded before it is answered.
Each MCP message and REST call is written to the audit log, and that write finishes before the response is sent. GET /api/v1/audit covers the stores your credential reaches, pages with limit and the opaque before cursor (with an explicit has_more), filters by subject_ref to answer “which call made this refund”, and returns CSV with format=csv. Reading the audit log is itself audited.
What else is recorded, and how long it is kept, is on the Trust Center.
curl "https://app.magistry.io/api/v1/audit?limit=50&format=csv" \
-H "Authorization: Bearer mag_sk_live_…"Build on the same tools the product uses.
Create a sandbox key on demo data, or start free and connect a real store.
MCP + REST · OAuth 2.1 or API keys · every call audited