Skip to content

Limits#

This page documents the current public limits for the PhishFort Client API.

Request throttling#

Incident reports#

Incident report submissions are limited to 60 per minute per account. The budget belongs to the account that owns the API key: reports filed for sub-clients, and reports sent with several keys of the same account, all count against the same budget. Every submission attempt counts, including ones rejected as duplicates or as invalid requests.

The limit applies to both report endpoints:

  • POST /v1/incident/tkd
  • POST /v1/incident/monitor

A submission beyond the budget receives a 429 response with a Retry-After header holding the number of seconds until the budget resets (at most 60). The incident is not created and nothing is queued, so resend the same report once the wait has passed:

{
    "error": true,
    "message": "Too many incident reports: this account has reached its limit of 60 reports per minute. Retry after 30 seconds."
}

To stay under the limit when submitting a batch, send reports sequentially and pause when a 429 arrives. If your integration retries failed submissions, retry only once the earlier request has returned: a report that times out on your side may still have been accepted, and resending it is counted as a new submission (and then rejected as a duplicate).

If a legitimate workflow needs a higher budget, contact PhishFort support.

Other endpoints#

The Client API does not currently publish a per-API-key sustained RPS, burst RPS, or daily quota for the other endpoints. POST /v1/incident/{id}/attach shares the same API infrastructure as the report endpoints but does not count against the incident report budget.

Response Action
200–299 Success.
400, 401, 403, 404, 413, 422 Terminal — do not retry, fix the request.
429 Wait for the number of seconds in the Retry-After header, then retry. When the header is absent, retry with bounded exponential backoff and jitter.
5xx Retry with bounded exponential backoff and jitter.

Attachments#

Attachment uploads use multipart form data. Uploads do not use a signed URL flow; signed URLs are only returned when reading or downloading existing attachments.

A single request can include up to 12 files by repeating the attachments multipart field, and the total request size — including all files and form fields — must stay under 10 MB. Because multipart encoding adds overhead, keep the combined raw file size comfortably below 10 MB.

Requests that exceed the 10 MB request size limit receive a 413 response:

{
    "statusCode": 413,
    "error": "Request Entity Too Large",
    "message": "Payload content length greater than maximum allowed: 10485760"
}

Comment length#

A comment can be up to 5,000 characters. The limit applies to:

Length is counted in UTF-16 code units, so some emoji and symbols count as two characters.

A longer comment receives a 400 response, and nothing is saved: the incident is not created, or the comment is not added.

{
    "error": true,
    "message": "Comment is too long. Comments are limited to 5000 characters."
}

The request is terminal, so do not retry it unchanged. Shorten the comment, or split a long note into several comments with POST /v1/incident/{id}/comment.