Limits and errors

Limits keep one app from overloading an account or our API. When you hit one, the answer says which, and 429 answers carry a Retry-After header with the seconds to wait.

Limits

What	Limit
API calls per connected account	600 a minute
API calls per app, all accounts together	1,200 a minute while not verified, 12,000 a minute once verified
WhatsApp API calls per account	The account plan's per-minute limit, shared by its own API key and every connected app
Sends per connected account, apps never verified	500 a day (India day, resets at midnight India time). A send is one call to a sending route.
Bulk email sending	Verified apps only
Addresses per email, apps never verified	One: `to`, `cc` and `bcc` together. Each address is one email, so the daily limit counts emails.
Connected accounts per app	25 while never verified, no limit once verified
Token calls per app	600 a minute while not verified, 6,000 once verified, counted only after your client authenticated
Revoke calls per app	120 a minute
Refreshes per connection	60 an hour
Failed client authentications per IP address	60 a minute, then 429 until the minute ends
Failed client authentications for your Client ID from one IP address	10 in 10 minutes blocks that address for your Client ID for 15 minutes
Apps per developer account	10
Redirect URLs per app	10
Client secrets per app	2
Live token sets per connection	5; a sixth signs out the oldest

A verified app that loses its badge keeps the verified limits while we check it again. If your verified app needs more, write to [email protected].

Answers from the token gate

These come before the endpoint runs. WhatsApp routes (/api/v1/public/*) use the result shape; Email routes (/api/v1/partner/email/*) use {"error": "<code>", "message": "..."} with the same codes and texts.

Status	Body	`Retry-After`
401	`{"result":false,"code":"invalid_token","message":"The access token is not valid. It may have expired or the app was removed."}` with `WWW-Authenticate: Bearer realm="splashifypro", error="invalid_token"`. Also for a token of the other platform ("This token is for Splashify Pro Email.").	no
403	`{"result":false,"code":"account_inactive","message":"Account is not active"}`	no
403	`{"result":false,"code":"endpoint_not_allowed","message":"Connected apps cannot use this endpoint."}`	no
403	`{"result":false,"code":"insufficient_scope","message":"This app was not allowed to do this.","required_scope":"whatsapp.messages:send"}` with `WWW-Authenticate: Bearer realm="splashifypro", error="insufficient_scope", scope="whatsapp.messages:send"`	no
403	`{"result":false,"code":"verified_only","message":"Bulk sending needs a verified app."}`	no
403	Email only, a send with more than one address in `to`, `cc` and `bcc` together from an app never verified: `{"error":"verified_only","message":"Sending one email to more than one address needs a verified app."}`	no
429	`{"result":false,"code":"rate_limited","message":"Too many requests from this app. Try again in a minute."}`	yes
429	`{"result":false,"code":"daily_send_limit","message":"This app has reached its daily sending limit for this account. It resets at midnight India time."}`	yes, seconds to midnight India time

Answers from the account's plan (WhatsApp)

After the token gate, the account's own plan rule runs, the same as for its API key:

Status	Body	`Retry-After`
403	`{"result":false,"code":"subscription_inactive","message":"An active subscription is required to use Public APIs."}`	no
403	`{"result":false,"code":"no_api_plan","message":"Public APIs are not accessible on your current plan. Please upgrade."}`	no
429	`{"result":false,"code":"rate_limited","message":"Rate limit exceeded for this resource. Limit: <n> requests/minute. Error Code: 429"}`	yes

IP allowlist (both platforms)

Status	Body
403	`{"success":false,"code":"ip_blocked","ip":"203.0.113.45","message":"..."}`

The account only accepts API calls from its allowed addresses. Ask the customer to add your server addresses.

Token endpoint

Status	Body	`Retry-After`
400	`{"error":"invalid_request","error_description":"..."}`	no
401	`{"error":"invalid_client","error_description":"..."}` with `WWW-Authenticate: Basic realm="splashifypro"`	no
400	`{"error":"unauthorized_client","error_description":"..."}` (app or developer account suspended)	no
400	`{"error":"invalid_grant","error_description":"..."}`	no
400	`{"error":"unsupported_grant_type","error_description":"..."}`	no
400	`{"error":"invalid_scope","error_description":"..."}`	no
429	`{"error":"rate_limited"}`	yes

The revoke endpoint uses the same client authentication answers and otherwise always answers 200 {}.

What to do

You got	Do this
`401 invalid_token`	Refresh. If the refresh gets `invalid_grant`, the account removed your app or the connection was signed out: ask the user to connect again.
`403 insufficient_scope`	Send the user to the authorize page with the permission you need. If it is a restricted permission, your app must be verified first.
`403 endpoint_not_allowed`	The endpoint is not open to connected apps. See Calling the API.
`403 no_api_plan` or `subscription_inactive`	The customer needs a plan with API access. Nothing you can fix in code.
`429`	Wait for `Retry-After` seconds, then try again. Spread bursts out.
`daily_send_limit`	Wait for midnight India time, or get your app verified to remove the limit.