## 7.1.10  Rate Limiting
This section provides information on the rate limiting in the SAP Authorization and Trust Management service.
The SAP Authorization and Trust Management service acts as an OAuth authorization server and issues access tokens with a long validity. These tokens are meant to be reused. However, some OAuth clients don't reuse them and thus cause a high load. The SAP Authorization and Trust Management service is scaled per landscape to handle the load.
To protect the SAP Authorization and Trust Management service from overload of misbehaving OAuth clients, rate limiting has been introduced. The limit is per subaccount.
- Requests sent at a lower rate are processed directly.
- When the limit for a subaccount is exceeded, the requests are queued and sent to the SAP Authorization and Trust Management service at a maximum rate (see table). The response times increase because of the queuing.
- If too many requests are queued so that the response time due to queuing exceeds a certain time, the service sends an HTTP 429 response code. This response also contains the http Retry-After header, which indicates when the client can retry.
##  Recommendation
There might be company events that trigger a lot of users to log on and try to access one special resource, such as the launch of a special employee discount sale for a certain day. Therefore, it's very likely that a high load of users will try to log on to the special discount website at the announced time. This means that you can foresee that users might run into HTTP 429 error response codes.
- We recommend sending the announcement emails in waves. By doing so, you can avoid a situation where almost all users try to log on at about the same time.
- Additionally, it's helpful to handle the HTTP 429 error message by also sending a clear text message like We are sorry, but the server is currently experiencing high demand. Please try again later. Such a message gives the users guidance of what to do.
##  Note
Since rate limiting is per subaccount, SaaS applications probably don't notice rate limiting because the load is distributed across different SaaS subaccounts.
<!-- image -->
|  Restriction                                                  |  Restriction                                                  |
|----------------------------------------------------------------|----------------------------------------------------------------|
| The following table lists sizing restrictions when using APIs. | The following table lists sizing restrictions when using APIs. |
| Sizing Restrictions                                            | Sizing Restrictions                                            |
| Element                                                        | Maximum Size                                                   |
| HTTP header                                                    | 16 KB                                                          |
| POST body                                                      | 1MB                                                            |
## Token Endpoint
The token endpoint enables you to authenticate with OAuth 2.0.
Token Endpoint
| Endpoint                                                           | Subaccount Limit                               | Effect                                                      |
|--------------------------------------------------------------------|------------------------------------------------|-------------------------------------------------------------|
| https:// <subdomain>.authentication .<landscape>/oauth/token       | Up to 60 requests per second                   | The requests are executed at once.                          |
| https:// <subdomain>.authentication .<landscape>/oauth/token       | Exceeding 60 requests per second               | The requests are queued and then exe- cuted.                |
| https:// <subdomain>.authentication .<landscape>/oauth/token       | Significantly exceeding 60 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
| https:// <subdomain>.authentication .cert.<landscape>/oauth/ token | Up to 60 requests per second                   | The requests are executed at once.                          |
| Endpoint                                                           | Subaccount Limit                               | Effect                                                      |
|--------------------------------------------------------------------|------------------------------------------------|-------------------------------------------------------------|
| https:// <subdomain>.authentication .cert.<landscape>/oauth/ token | Exceeding 60 requests per second               | The requests are queued and then exe- cuted.                |
| https:// <subdomain>.authentication .cert.<landscape>/oauth/ token | Significantly exceeding 60 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
## Authorization, Security Settings, and Identity Provider Management APIs
The authorization, security settings, and identity provider management APIs enable you to manage service instances, roles, role templates, role collections, and identity providers. You find the APIs of SAP Authorization and Trust Management service and of the security settings in the SAP Business Accelerator Hub .
Authorization, Security Settings, and Identity Provider APIs
| Endpoint                                                                                                                                               | Subaccount Limit                 | Effect                                       |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|----------------------------------------------|
| https:// api.authentication.<landsc ape>/sap/rest/ authorization/v2 (Including all APIs with sub- paths, for example sap/rest/ authorization/v2/apps ) | Up to 45 requests per second     | The requests are executed at once.           |
| https:// api.authentication.<landsc ape>/sap/rest/ authorization/v2 (Including all APIs with sub- paths, for example sap/rest/ authorization/v2/apps ) | Exceeding 45 requests per second | The requests are queued and then exe- cuted. |
| Endpoint                                                                                                                                                 | Subaccount Limit                               | Effect                                                      |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|-------------------------------------------------------------|
| https:// api.authentication.<landsc ape>/sap/rest/ authorization/v2 (Including all APIs with sub- paths, for example sap/rest/ authorization/v2/apps )   | Significantly exceeding 45 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
| https:// api.authentication.<landsc ape>/sap/rest/identity- providers (Including all APIs with subpaths, for example sap/rest/identity-                  | Up to 30 requests per second                   | The requests are executed at once.                          |
| https:// api.authentication.<landsc ape>/sap/rest/identity- providers (Including all APIs with subpaths, for example sap/rest/identity- providers/{id} ) | Exceeding 30 requests per second               | The requests are queued and then exe- cuted.                |
| https:// api.authentication.<landsc ape>/sap/rest/identity- providers (Including all APIs with subpaths, for example sap/rest/identity- providers/{id} ) | Significantly exceeding 30 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
## User Management (SCIM) APIs
The user management (SCIM) APIs enable you to manage shadow users and role collections. You find the APIs of SAP Authorization and Trust Management service in the SAP Business Accelerator Hub .
User Management (SCIM) APIs
| Endpoint                                                                                                              | Subaccount Limit                              | Effect                                                      |
|-----------------------------------------------------------------------------------------------------------------------|-----------------------------------------------|-------------------------------------------------------------|
| https:// api.authentication.<landsc ape>/groups (Including all APIs with subpaths, for example sap/rest/groups/{id} ) | Up to 3 requests per second                   | The requests are executed at once.                          |
| https:// api.authentication.<landsc ape>/groups (Including all APIs with subpaths, for example sap/rest/groups/{id} ) | Exceeding 3 requests per second               | The requests are queued and then exe- cuted.                |
| https:// api.authentication.<landsc ape>/groups (Including all APIs with subpaths, for example sap/rest/groups/{id} ) | Significantly exceeding 3 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
| https:// api.authentication.<landsc ape>/users (Including all APIs with subpaths, for example sap/rest/users/{id} )   | Up to 3 requests per second                   | The requests are executed at once.                          |
| https:// api.authentication.<landsc ape>/users (Including all APIs with subpaths, for example sap/rest/users/{id} )   | Exceeding 3 requests per second               | The requests are queued and then exe- cuted.                |
| https:// api.authentication.<landsc ape>/users (Including all APIs with subpaths, for example sap/rest/users/{id} )   | Significantly exceeding 3 requests per second | An HTTP 429 Too Many Requests response status code is sent. |
## Related Information
Application Security Descriptor Configuration Syntax [page 576] Accessing Administration Using APIs of the SAP Authorization and Trust Management Service [page 2495]