WHMCS rate limits the following endpoints and returns HTTP status code 429 if you exceed 30 requests to that endpoint in five minutes:

• POST /user/invoices/{invoice_id}/payment-link
• POST /user/invoices/{invoice_id}/payment-session
• POST /user/invoices/{invoice_id}/payment-session/confirm
• DELETE /user/paymethods/{paymethod_id}

WHMCS does not rate limit other API endpoints.

The API limits endpoints using the client IP address and route, not the client or user ID. A server-side integration that acts for many clients shares a single allowance per route.

A request past the limit returns the following response:

HTTP/1.1 429 Too Many Requests

{"message":"Rate Limit Exceeded"}

The response includes no Retry-After header and no X-RateLimit-* headers. Ensure that your application spaces requests appropriately.