AmeriHealth Caritas · Rate Limits

Amerihealth Caritas Rate Limits

The AmeriHealth Caritas developer portal does not publish numeric rate limits for its FHIR R4 APIs. Limits are administered behind the scenes consistent with CMS Patient Access expectations and reasonable- use protections, scoped per registered application and per member token. Production apps that exceed fair-use thresholds are contacted directly. Sandbox endpoints are bound by similar reasonable-use ceilings without published numbers. Token lifetimes are explicitly short-lived: the documented OAuth `expires_in` is 3600 seconds (1 hour); refresh tokens are subject to revocation when member consent is withdrawn.

Amerihealth Caritas Rate Limits is the machine-readable rate-limit profile for AmeriHealth Caritas on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 6 rate-limit definitions, measuring requests_per_second, seconds, and revocable.

The profile also includes 7 backoff/retry policies defined.

Tagged areas include Rate Limiting, FHIR, Healthcare, CMS, and SMART On FHIR.

6 Limits
Rate LimitingFHIRHealthcareCMSSMART On FHIR

Limits

Patient Access FHIR requests (production) app + member_token
requests_per_second
not publicly published; reasonable-use enforcement
Member-authorized FHIR queries; throttled to protect platform but no public RPS number.
Provider Directory FHIR requests app
requests_per_second
not publicly published; reasonable-use enforcement
Drug Formulary FHIR requests app
requests_per_second
not publicly published; reasonable-use enforcement
Sandbox FHIR requests ip
requests_per_second
not publicly published; reasonable-use enforcement
Sandbox uses synthetic data; no member PHI risk but limits still apply.
OAuth Access Token Lifetime token
seconds
3600
Documented `expires_in` in the developer portal sample token response is 3600 seconds.
OAuth Refresh Token Lifetime token
revocable
revocable
Refresh tokens are subject to revocation when member consent is withdrawn.

Policies

SMART on FHIR Authorization
Production member data access requires SMART on FHIR / OAuth 2.0 with explicit member consent at https://member.amerihealthcaritas.com/patientaccesssvc/oauth2/v1/authorize. Tokens are short-lived and refresh tokens are subject to revocation.
PKCE for Public Clients
Mobile, SPA, and any client unable to keep a Client Secret must use the PKCE authorization code flow with `code_challenge` and `code_challenge_method=S256`.
Application Attestation
Developer apps must complete the AmeriHealth Caritas attestation aligning with CMS privacy and data-use expectations before production access is granted.
Backoff Strategy
Implement exponential backoff and honor any `Retry-After` response header; pace requests conservatively given the absence of published numeric limits.
Per-Plan Endpoint Selection
Select the correct four-digit plan code (e.g. 0100, 0500, 0900, 1200, 2100, 2400, 2600) for the member's plan rather than assuming a single shared endpoint.
Cache Public Reference Data
Provider Directory and Drug Formulary responses are public and change infrequently; cache aggressively with conditional ETag / Last-Modified handling where supported.
HIPAA Logging Hygiene
Do not log raw FHIR bodies containing PHI to shared observability sinks; redact identifiers and narrow log retention.

Sources