Limits & errors

Defaults

Defaults are platform settings and may be adjusted per plan or endpoint.

Limit	Default
Request body size (ingestion)	1 MB (endpoint can lower it; hard maximum 5 MB)
Ingestion rate per endpoint	600 events / minute (configurable per endpoint)
Per-IP abuse ceiling on ingestion	12,000 requests / minute per source IP (platform setting)
Per-organization ceiling	6,000 events / minute across all endpoints (platform setting)
Destination timeout	10 s (1–30 s)
Max delivery attempts	8 (1–30)
De-duplication window	24 h by source event id (configurable, 0 disables)
Captured response body	16 KB per attempt
Payload retention	30 days; event metadata, delivery history and usage records are kept
Test console	10 events / minute / organization; test events are not billed
Replay size	Up to 10,000 deliveries per operation

De-duplication

Retryx looks for a source event id in this order: Stripe id; GitHub X-GitHub-Delivery; Shopify X-Shopify-Webhook-Id; for custom sources the X-Event-Id / X-Webhook-Id / Idempotency-Key header, then a top-level id in a JSON body. Duplicates inside the window are dropped (200 duplicate) and are never stored, delivered or billed.

REST API conventions

Authenticate with Authorization: Bearer rx_… (organization API key, scoped) from your backend, or use the dashboard session.
List endpoints use cursor pagination: ?limit=25&cursor=…, newest first, response {"data":[…],"nextCursor":"…"|null}.
Resources of other organizations answer 404, never 403.

Error format

{
  "error": {
    "code": "validation_error",
    "message": "Invalid request",
    "details": [{ "path": "url", "message": "Invalid url" }],
    "requestId": "9d6f…"
  }
}

Include requestId when contacting support. Rate-limited responses (429) include Retry-After.

Common error codes

code	HTTP	Meaning
`validation_error`	400	Body or query failed validation; see details.
`unauthorized`	401	Missing or invalid credentials.
`forbidden`	403	Authenticated but not allowed (role or API-key scope).
`not_found`	404	No such resource in your organization.
`invalid_destination_url`	422	Destination URL rejected by the outbound-security policy.
`rate_limited`	429	Slow down; see Retry-After.
`schema_validation_failed`	422	Ingested payload does not match the endpoint’s JSON Schema.