Rate Limits

Zus applies rate limits as part of our information security posture to defend against abuse by bad actors. Some Zus services also have specific usage quotas to help ensure a consistent experience for all customers:

• FHIR endpoints at api.zusapi.com and fqs.zusapi.com - Customer requests are limited to a rate of 2,000 requests per min per customer (builder id). The endpoints will return HTTP 429 responses for request volumes exceeding this limit.
• Token requests - Token authentication is subject to a special rate limit, as calling systems are expected to acquire a token and continue to use it until it expires. If your application attempts to obtain a token for the same app client more than 200 times in an hour, the application will receive a 429 error. User authentication (using a username and password) is not subject to this limit.
• Patient history API and data subscriptions - To manage request loads to national data networks, each patient is limited to a rate of 1 request per patient per 24 hours. Additionally, each customer (builder id) is limited to a rate of 10 requests per minute for priority jobs. This same customer-level rate limit applies to priority patient enrollments.