Veracode · Rate Limits

Veracode Rate Limits

Veracode does not publish numeric per-second / per-minute API rate limits, but documents concrete throttling and retry guidance in its API Best Practices. Excessive polling triggers throttling; HTTP 429 is returned with a retry-after header. Veracode also publishes operational guidance (minimum poll interval, retry budget) that consumers must follow to stay below the throttle threshold.

Veracode Rate Limits is the machine-readable rate-limit profile for Veracode on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 2 rate-limit definitions, measuring requests_per_minute and varies.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Application Security, SAST, DAST, SCA, and DevSecOps.

2 Limits Throttle: 429
Application SecuritySASTDASTSCADevSecOpsRate Limiting

Limits

Status-check polling minimum interval account
requests_per_minute
1 every 2 minutes (recommended minimum spacing for status polls)
Veracode best practices mandate at least two minutes between status check calls; excessive polling will be throttled.
General API throttling threshold account
varies
not numerically published; throttling engages when polling / call rate is excessive
Veracode does not publish a global RPS / RPM ceiling; throttle behavior is account-scoped.

Policies

Honor retry-after on 429
On HTTP 429, clients must read the retry-after header and wait at least that long before retrying.
Five-retry maximum
Veracode best practices cap retries at five attempts to handle transient network issues; beyond that, fail and surface the error.
Use Reporting / Findings APIs for bulk pulls
For large-scale data retrieval, use the Reporting API rather than polling per-application endpoints; for near real-time per-app data, use the Findings or Summary Report REST APIs.
Use service accounts
Automations should run under API service accounts (with the dedicated API role), not under user accounts; credentials expire after 365 days and must be rotated.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/veracode-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.