bunq · Rate Limits

Bunq Rate Limits

bunq applies rate limits per endpoint, tracked per IP address / API key / session, across both sandbox and production. The classic doc.bunq.com model is per-HTTP-method, per-endpoint, per-IP: roughly 3 GET per 3 seconds, 5 POST per 3 seconds, and 2 PUT per 3 seconds, with the /session-server endpoint held to a much stricter ceiling (about 1 request per 30 seconds). bunq's newer documentation frames limits as per-endpoint categories that vary by sensitivity - high-volume payment endpoints allow far more, while setup/installation and security-sensitive endpoints allow far fewer. Limits are not tied to a paid plan. Exceeding a limit returns HTTP 429 with a message stating the exact allowance for that endpoint.

Bunq Rate Limits is the machine-readable rate-limit profile for bunq on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 6 rate-limit definitions, measuring requests_per_3_seconds, requests_per_30_seconds, requests_per_day, and callback_urls_per_category.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and quotaExceeded.

Tagged areas include Banking, Neobank, Rate Limiting, Throttling, and SEPA.

6 Limits Throttle: 429 Quota: 429
BankingNeobankRate LimitingThrottlingSEPA

Limits

GET requests (general) IP/endpoint
requests_per_3_seconds · second
3
Classic baseline - 3 GET requests per 3 seconds per IP per endpoint.
POST requests (general) IP/endpoint
requests_per_3_seconds · second
5
Classic baseline - 5 POST requests per 3 seconds per IP per endpoint.
PUT requests (general) IP/endpoint
requests_per_3_seconds · second
2
Classic baseline - 2 PUT requests per 3 seconds per IP per endpoint.
/session-server endpoint IP/endpoint
requests_per_30_seconds · second
1
Stricter limit on session creation (about 1 request per 30 seconds per IP). Reuse sessions.
Setup / installation endpoints endpoint
requests_per_day
very low
Newer docs describe installation/setup calls as heavily restricted (as low as ~10 per day). Register once and reuse.
Callback URL configuration account
callback_urls_per_category
2
A limited number of callback URLs may be configured per notification category.

Policies

Per-Endpoint Scoping
Limits apply per endpoint (and, in the classic model, per HTTP method) per IP - not as a single global bucket.
Read the 429 Message
On HTTP 429 the response states the exact allowance ("maximum of X calls per Y seconds to this endpoint"); build retry logic around that value.
Session Endpoint Hardening
The /session-server endpoint enforces a much stricter ceiling; reuse an open session rather than re-authenticating per call.
Backoff Strategy
Use exponential backoff with jitter when 429 is observed. bunq does not document a Retry-After header, so backoff intervals are client-managed.

Sources