Limitations

The Commercial API serves up to 500 requests per minute per subscription. The limit applies to every authenticated endpoint and counts every request, whether or not the query found the CNPJ.

Counting uses a sliding 60-second window: there is no minute boundary that resets the counter. Each request stops counting 60 seconds after it was made.

In addition to the subscription limit, there is a per-IP limit that adds up the requests of every subscription calling the API from the same address. The per-IP limit is never lower than your subscription limit: a subscription calling the API alone from an address reaches its own limit first.

When either limit is exceeded, the API responds with HTTP Status Code 429:

{
  "status": 429,
  "titulo": "Muitas requisições",
  "detalhes": "Excedido o limite máximo de 500 requisições por minuto por assinatura. Liberação ocorrerá em 13/10/2026, 11:47:12",
  "validacao": []
}

The release time comes only as Portuguese text inside detalhes, in Brasília time. The response does not include a Retry-After header. When you receive a 429, wait 60 seconds before trying again and do not parse the detalhes text.

Best practices

• Pace requests on your side. Spread calls across the minute instead of firing them all at once.
• Limit concurrency. Many parallel requests exhaust the limit in seconds.
• Back off on 429. Retrying immediately only extends the block.
• Avoid repeated queries. Store the result of CNPJs you have already queried in your own system.

Monthly limit

The per-minute limit is independent of the monthly query limit of the contracted plan. To track consumption for the period, use the consumption endpoint.