API rate limit

A rate limit states how much a client may pull, and the strongest ones are contractual. openFDA's device endpoints, including 510(k) clearance lookups, carry terms noting they are subject to rate limits and to openFDA's Right to Limit clause - throttling as contract, not accident.

Cataloged ceilings vary widely. Shodan applies 1 request per second across all API plans. RIPE's database AUP allows 1,000 results per IP per 24 hours (20,000 per proxy IP) with 3 simultaneous connections, and warns that exceeding limits triggers temporary blocks; RIPEstat separately caps 8 concurrent requests per IP. At the slow end, Spamhaus DROP lists prohibit fetching more than once per hour, and the Public Suffix List asks for once-daily downloads.

ClinicalTrials.gov's API v2 notes tell heavy users when the API is the wrong tool altogether: use bulk export rather than paginating the full registry.

A collection plan sized against a brochure instead of the AUP fails mid-build. Limits decide whether daily refresh is physically possible, how many IPs or credentials a job needs, and whether a vendor's promised cadence can exist at all.

• Blocks interrupt delivery, not just experiments. RIPE states that exceeding limits triggers temporary blocks, and Spamhaus may firewall fetchers that poll more than hourly - an outage your side caused and cannot escalate away.
• Identification is sometimes the unlock. RIPEstat asks users regularly exceeding 1,000 requests per day to register a sourceapp identifier - publishers trade headroom for accountability.
• Bulk beats pagination at scale. When a registry itself recommends export over paginating 100,000-plus records, an API-only architecture is a design error.

Use these checks to test whether a source delivers what the concept promises:

1. Find the enforcing clause, not the FAQ. openFDA's Right to Limit is contractual language; ask a vendor to quote their source's equivalent.

1. Do the arithmetic against stated ceilings. At Shodan's 1 request per second, a day yields at most 86,400 calls - size the job before signing.

1. Prefer bulk where the publisher says so. ClinicalTrials.gov's own terms_notes steer heavy users to bulk export instead of paginating the registry.

1. Check minimum fetch intervals. Spamhaus DROP prohibits more than one fetch per hour; sub-hourly polling is non-compliant by construction.

1. Ask whether the vendor registered. RIPEstat asks users regularly exceeding 1,000 requests per day to register a sourceapp identifier - a concrete question any operator can answer.

Where to see it in context: health-care-equipment data, health-care-supplies data.

Entries that pair with rate-limit planning:

• bulk-download
• official-api-access
• openfda
• whois