Overview

The Corrigo platform enforces API rate limits to ensure platform stability, performance, and availability for all tenants. This document explains the rate limiting policy, what happens when limits are exceeded, and how your integration should be designed to avoid disruption.

Failure to comply with these limits can result in temporary blocking or permanent IP blacklisting, which affects all API consumers on your network.

Rate Limit Threshold

The following hard limit is enforced by Akamai, Corrigo’s security layer:

Limit 20 requests per second (sustained for more than 2 minutes)

Exceeding this threshold triggers automatic defensive action. The limit applies to all API endpoints and is evaluated at the IP address level.

What Happens When Limits Are Exceeded

First Violation — Temporary Block

If your application sustains more than 20 requests per second for over 2 minutes:

• Your IP address is temporarily blocked by Akamai.
• The block lasts approximately 10 minutes.
• All API requests from the blocked IP are rejected during this window.

Repeat Violations — Permanent Blacklisting

If the high-volume pattern resumes after a temporary block is lifted:

• The repeat behavior is treated as a persistent threat.
• Your IP address is permanently blacklisted.
• All future requests from that IP are blocked indefinitely.
• Recovery requires manual intervention and review.

Why These Limits Exist

High-volume, persistent API requests originating from a single source can trigger patterns consistent with a Distributed Denial of Service (DDoS) attack. When such patterns emerge, our security systems cannot immediately distinguish between unintentional traffic from a legitimate application and malicious activity from a third party attempting to compromise our infrastructure.

The automatic blocking response from our security layer is a critical defensive measure to protect Corrigo APIs and infrastructure from potential service disruption. This ensures continued availability and performance for all users across the platform.

Real-World Example

A Corrigo API consumer began sending API requests at a rate that exceeded the threshold. Akamai detected the sustained high-volume pattern and issued a temporary 10-minute block. When the consumer restarted its API processes, it immediately resumed the same pattern. Because the violation was repeated immediately after the block was lifted, the IP address was permanently blacklisted and all future requests were rejected.

This incident required manual investigation and remediation, resulting in extended downtime for the affected client. The situation could have been avoided with proper rate management in the client application.

Checking Your Blacklist Status

Akamai provides a public-facing URL where you can check whether your IP address has been blacklisted. Please contact Corrigo Support or your Integration Engineer to obtain the current lookup URL, as this link may be updated periodically.
If you believe your IP has been incorrectly blocked or need to request removal from the blacklist, contact Corrigo Support with your IP address details and a description of your API usage pattern.

Developer Best Practices

To avoid triggering rate limits, your integration should implement the following:

• Stay well below 20 req/sec — design for a sustained rate of 10 req/sec or fewer as a safe ceiling.
• Implement exponential backoff — if you receive HTTP 429 (Too Many Requests) or connection errors, pause and retry with increasing delays.
• Use request queuing — do not fire all API calls simultaneously; use a queue with controlled concurrency.
• Avoid polling — use webhooks or event-driven patterns instead of continuous polling on endpoints.
• Test with production-like volumes — validate your integration’s request rate before go-live.
• Monitor your traffic — set up alerts if your application’s API call rate approaches the limit.
• Distribute load over time — schedule batch operations during off-peak hours and spread requests evenly.

Support & Escalation

If you have questions about rate limits, believe you have been incorrectly blocked, or need guidance on designing a compliant integration, reach out through the following channels:

• Developer documentation: developer.corrigo.com and developer.corrigopro.com
• Corrigo Support: raise a case through the standard support portal
• Integration Engineers: contact your assigned IE for architecture guidance