OneTrust · Rate Limits

Onetrust Rate Limits

OneTrust publishes account-level and module-level rate limits in full, including the exhaustion status code and the exact response headers it returns. The previous version of this artifact said "not publicly documented" — that was wrong; the numbers were on the developer portal.

Onetrust Rate Limits is the machine-readable rate-limit profile for OneTrust on the APIs.io network, in the API Commons Rate Limits shape.

It captures 12 rate-limit definitions, measuring requests and webhook calls.

The profile also includes 2 backoff/retry policies defined.

Tagged areas include Privacy, GRC, Rate Limiting, Quotas, and Throttling.

12 Limits
Transcribed from the provider's documentation on 2026-08-27 — developer.onetrust.com/onetrust/reference/rate-limits-ove....
View Source
PrivacyGRCRate LimitingQuotasThrottling

Limits

Default Hour Rule account
requests · per hour
200000/hour
Default API Rate Limit per-endpoint
requests · per minute
1000/minute
Sandbox Default Hour Rule account
requests · per hour
50000/hour
Sandbox Default API Rate Limit per-endpoint
requests · per minute
250/minute
Default Integration Webhook Minute Rule per-endpoint
webhook calls · per minute
3000/minute
Consent receipts 2k Per Minute Rule per-endpoint
requests · per minute
2000/minute
Preferences 3k Per Minute Rule per-endpoint
requests · per minute
3000/minute
Data subjects basic-details 1k Per Minute Rule per-endpoint
requests · per minute
1000/minute
Data subjects details 1k Per Minute Rule per-endpoint
requests · per minute
1000/minute
Data subjects ds-profiles 1k Per Minute Rule per-endpoint
requests · per minute
1000/minute
Data subjects profiles-by-purpose 1k Per Minute Rule per-endpoint
requests · per minute
1000/minute
Default Consent Ingestion Provisioned per-endpoint
requests · per minute
3000/minute

Policies

Overrides
Existing customer workloads that exceed default thresholds can be covered by approved overrides, evaluated case by case. Overrides are not automatically provisioned for new implementations or traffic increases. Requests to OneTrust Support must include tenant ID, API endpoint, request volume and business justification.
Backoff
OneTrust's published best practice is to honor Retry-After and implement exponential backoff. The docs ship a Python example that reads all five ot-* headers.

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/onetrust-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.