AmeriHealth Caritas · Rate Limits

Amerihealth Caritas Rate Limits

The AmeriHealth Caritas developer portal does not publish numeric rate limits for its FHIR R4 APIs. Limits are administered behind the scenes consistent with CMS Patient Access expectations and reasonable- use protections, scoped per registered application and per member token. Production apps that exceed fair-use thresholds are contacted directly. Sandbox endpoints are bound by similar reasonable-use ceilings without published numbers. Token lifetimes are explicitly short-lived: the documented OAuth `expires_in` is 3600 seconds (1 hour); refresh tokens are subject to revocation when member consent is withdrawn.

Amerihealth Caritas Rate Limits is the machine-readable rate-limit profile for AmeriHealth Caritas on the APIs.io network, in the API Commons Rate Limits shape.

It captures 6 rate-limit definitions, measuring requests_per_second, seconds, and revocable.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 7 backoff/retry policies defined.

Tagged areas include Rate Limiting, FHIR, Healthcare, CMS, and SMART On FHIR.

6 Limits
Method: generated, dated 2026-05-23.
Written by API Evangelist on 2026-05-23 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
Rate LimitingFHIRHealthcareCMSSMART On FHIR

Limits

Patient Access FHIR requests (production) app + member_token
requests_per_second
not publicly published; reasonable-use enforcement
Member-authorized FHIR queries; throttled to protect platform but no public RPS number.
Provider Directory FHIR requests app
requests_per_second
not publicly published; reasonable-use enforcement
Drug Formulary FHIR requests app
requests_per_second
not publicly published; reasonable-use enforcement
Sandbox FHIR requests ip
requests_per_second
not publicly published; reasonable-use enforcement
Sandbox uses synthetic data; no member PHI risk but limits still apply.
OAuth Access Token Lifetime token
seconds
3600
Documented `expires_in` in the developer portal sample token response is 3600 seconds.
OAuth Refresh Token Lifetime token
revocable
revocable
Refresh tokens are subject to revocation when member consent is withdrawn.

Policies

SMART on FHIR Authorization
Production member data access requires SMART on FHIR / OAuth 2.0 with explicit member consent at https://member.amerihealthcaritas.com/patientaccesssvc/oauth2/v1/authorize. Tokens are short-lived and refresh tokens are subject to revocation.
PKCE for Public Clients
Mobile, SPA, and any client unable to keep a Client Secret must use the PKCE authorization code flow with `code_challenge` and `code_challenge_method=S256`.
Application Attestation
Developer apps must complete the AmeriHealth Caritas attestation aligning with CMS privacy and data-use expectations before production access is granted.
Backoff Strategy
Implement exponential backoff and honor any `Retry-After` response header; pace requests conservatively given the absence of published numeric limits.
Per-Plan Endpoint Selection
Select the correct four-digit plan code (e.g. 0100, 0500, 0900, 1200, 2100, 2400, 2600) for the member's plan rather than assuming a single shared endpoint.
Cache Public Reference Data
Provider Directory and Drug Formulary responses are public and change infrequently; cache aggressively with conditional ETag / Last-Modified handling where supported.
HIPAA Logging Hygiene
Do not log raw FHIR bodies containing PHI to shared observability sinks; redact identifiers and narrow log retention.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/amerihealth-caritas-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.