In addition to the default rate limit applied per linked account, Merge also has a global rate limit to protect our API from malicious scanning. This rate limit kicks in when more than 20 requests from a single IP in a rolling 10 second window fail with an error status code (400 or higher, excluding 429 itself).

To avoid hitting this limit, we recommend implementing a backoff strategy that keeps the total number of API requests below the above limit when hitting an error.