PUBLISHED PROVIDER LIMITS
Limits keep their provider-specific dimensions.
GraphQL Admin limits use calculated query cost and plan-specific restore rates. REST Admin is legacy and uses a request leaky bucket.
Authentication: Admin API access token, Storefront access token where required
Primary scope: App And Store
Measured dimensions: Graphql Cost Points, Requests, Query Cost, Result Objects
Profile coverage: Current GraphQL Admin cost restore rates by plan, maximum single-query cost, selected platform limits, and legacy REST Admin leaky-bucket rates and headers. Storefront traffic protection and specialized Payments or Customer Account limits remain outside this profile.
Graphql Cost
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| GraphQL Admin restore rate, standard | 100 cost points | Per second | App Per Store | Published provider limit. |
| GraphQL Admin restore rate, Advanced | 200 cost points | Per second | App Per Store | Published provider limit. |
| GraphQL Admin restore rate, Plus | 1,000 cost points | Per second | App Per Store | Published provider limit. |
| GraphQL Admin restore rate, Enterprise | 2,000 cost points | Per second | App Per Store | Published provider limit. |
Request Complexity
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Maximum single GraphQL query cost | 1,000 cost points | At one time | Request | Published provider limit. |
Legacy Rest Rate
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Legacy REST Admin rate, standard | 2 requests | Per second | App Per Store | Published provider limit. |
| Legacy REST Admin rate, Advanced | 4 requests | Per second | App Per Store | Published provider limit. |
| Legacy REST Admin rate, Plus | 20 requests | Per second | App Per Store | Published provider limit. |
| Legacy REST Admin rate, Enterprise | 40 requests | Per second | App Per Store | Published provider limit. |
Result Limit
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Pagination array ceiling | 25,000 objects | At one time | Result Set | Published provider limit. |
RESPONSE METADATA
Headers expose the applicable limit state.
X-Shopify-Shop-Api-Call-LimitFormat: Used Over Capacity- Legacy REST Admin bucket usage represented as used capacity over maximum capacity.
Retry-AfterFormat: Decimal Seconds- Seconds to wait after a legacy REST Admin 429 response.
WHEN A LIMIT IS EXCEEDED
Read the response before choosing a delay.
- Rate-limit responses can use HTTP 429.
- GraphQL clients should use the cost extension. The documented HTTP headers in this profile apply to the legacy REST Admin API.
- Extensions.cost.throttleStatus: GraphQL cost limit, remaining capacity, and restore information.
RECOMMENDED HANDLING
Protect both the provider and your own queue.
- Use GraphQL throttleStatus to schedule requests by cost and restore rate.
- Reduce GraphQL query cost when the requested cost approaches available capacity.
- For legacy REST Admin calls, monitor the bucket header and honor Retry-After after a 429.
- Plan capacity by both store and app.
VERIFICATION RECORD