Veracode · Rate Limits

Veracode Rate Limits

Veracode does not publish numeric per-second / per-minute API rate limits, but documents concrete throttling and retry guidance in its API Best Practices. Excessive polling triggers throttling; HTTP 429 is returned with a retry-after header. Veracode also publishes operational guidance (minimum poll interval, retry budget) that consumers must follow to stay below the throttle threshold.

Veracode Rate Limits is the machine-readable rate-limit profile for Veracode on the APIs.io network, in the API Commons Rate Limits shape.

It captures 2 rate-limit definitions, measuring requests_per_minute and varies.

Limit state is signalled in the retryAfter response header, and an exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Application Security, SAST, DAST, SCA, and DevSecOps.

2 Limits Exhausted: HTTP 429 retryAfter
Method: generated, dated 2026-05-05.
Written by API Evangelist on 2026-05-05 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
Application SecuritySASTDASTSCADevSecOpsRate Limiting

Limits

Status-check polling minimum interval account
requests_per_minute
1 every 2 minutes (recommended minimum spacing for status polls)
Veracode best practices mandate at least two minutes between status check calls; excessive polling will be throttled.
General API throttling threshold account
varies
not numerically published; throttling engages when polling / call rate is excessive
Veracode does not publish a global RPS / RPM ceiling; throttle behavior is account-scoped.

Policies

Honor retry-after on 429
On HTTP 429, clients must read the retry-after header and wait at least that long before retrying.
Five-retry maximum
Veracode best practices cap retries at five attempts to handle transient network issues; beyond that, fail and surface the error.
Use Reporting / Findings APIs for bulk pulls
For large-scale data retrieval, use the Reporting API rather than polling per-application endpoints; for near real-time per-app data, use the Findings or Summary Report REST APIs.
Use service accounts
Automations should run under API service accounts (with the dedicated API role), not under user accounts; credentials expire after 365 days and must be rotated.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/veracode-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.