OneTrust · Rate Limits
Onetrust Rate Limits
OneTrust publishes account-level and module-level rate limits in full, including the exhaustion status code and the exact response headers it returns. The previous version of this artifact said "not publicly documented" — that was wrong; the numbers were on the developer portal.
Onetrust Rate Limits is the machine-readable rate-limit profile for OneTrust on the APIs.io network, conforming to the API Commons Rate Limits specification.
It captures 12 rate-limit definitions, measuring requests and webhook calls.
The profile also includes 2 backoff/retry policies defined.
Tagged areas include Privacy, GRC, Rate Limiting, Quotas, and Throttling.
12 Limits
PrivacyGRCRate LimitingQuotasThrottling
Limits
Default Hour Rule account
200000
Default API Rate Limit per-endpoint
1000
Sandbox Default Hour Rule account
50000
Sandbox Default API Rate Limit per-endpoint
250
Default Integration Webhook Minute Rule per-endpoint
3000
Consent receipts 2k Per Minute Rule per-endpoint
2000
Preferences 3k Per Minute Rule per-endpoint
3000
Data subjects basic-details 1k Per Minute Rule per-endpoint
1000
Data subjects details 1k Per Minute Rule per-endpoint
1000
Data subjects ds-profiles 1k Per Minute Rule per-endpoint
1000
Data subjects profiles-by-purpose 1k Per Minute Rule per-endpoint
1000
Default Consent Ingestion Provisioned per-endpoint
3000
Policies
Overrides
Existing customer workloads that exceed default thresholds can be covered by approved overrides, evaluated case by case. Overrides are not automatically provisioned for new implementations or traffic increases. Requests to OneTrust Support must include tenant ID, API endpoint, request volume and business justification.
Backoff
OneTrust's published best practice is to honor Retry-After and implement exponential backoff. The docs ship a Python example that reads all five ot-* headers.
Work with this as data
Every rate limit here is available over the APIs.io API and to AI agents over MCP.