The VAT API v2 provider does not publish a fixed numeric requests-per-second or monthly quota, so the limit that governs your integration is the one on your account plan. If your app gets an HTTP 429, pause, retry with a bounded backoff, and cut duplicate calls before anything else. The approach differs for HMRC’s VAT Making Tax Digital (MTD) API, which publishes its own standard limit, so confirm which service you are calling before you design around any number.
Confirm which VAT API you are calling
“VAT API” describes two separate services. The commercial VAT API v2 provides VAT rate data and rate checks. HMRC’s VAT MTD API is the UK tax authority’s interface for VAT filing. They have different authentication, different documented limits and different approval requirements, so a quota statement for one should never be applied to the other.
As an Amazon Associate I earn from qualifying purchases.
| Item | VAT API v2 (commercial rate service) | HMRC VAT MTD API (UK filing service) |
|---|---|---|
| Purpose | Retrieve VAT rates and check the VAT rate for a country code or IP address | Retrieve VAT obligations and submit VAT returns for UK businesses |
| Authentication | Valid x-api-key header on each request |
OAuth-based authorization, plus fraud-prevention header data |
| Published limit | None stated as a fixed number. The provider says its limits are dynamic and may be adjusted (VAT API documentation, checked October 2026) | Standard limit of 3 requests per second per application (HMRC Developer Hub reference guide, checked October 2026) |
| Monthly allowance | Set by your account plan; not stated in the provider documentation | Not stated in the reference guide cited |
| Documented 429 guidance | Reduce requests per minute, check plan allowance, look for repeated calls to the same resource or dataset | Pause briefly before retrying; avoid batching for real-time interactions |
| Official source | docs.vatapi.com | HMRC Developer Hub reference guide |
Request limits: what is published and what is not
VAT API v2
The provider documentation describes its limits as dynamic and reserves the right to change them. It does not give a stable requests-per-second figure or a monthly total, so any number you hardcode is an assumption. Look up your entitlement in your account plan and provider account information, then measure your own request volume over a normal day and during peak use. Treat the plan as the controlling source: if your plan changes, your ceiling changes with it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHMRC VAT MTD
HMRC’s limit applies per application, not per user or per business. Its reference guide also says that if you repeatedly reach the limit, you should contact HMRC about your application design. That is a signal to rethink call patterns, not just to add retries.
#1 Best Overall
Connect to VAT API v2 correctly
Most avoidable quota loss comes from misconfigured clients that retry failed authentication or call the wrong region. Set up the basics first:
- Endpoints: the EU endpoint is
https://eu.vatapi.com/v2and the Global endpoint ishttps://global.vatapi.com/v2. Choose one according to the provider’s documented deployment guidance, and keep it consistent across environments so cached data and logs stay comparable. - Authentication: send your key in the
x-api-keyheader on every request. Store it in a secrets manager or environment variable, never in client-side code or a public repository. - Rate-check parameters: the rate-check endpoint accepts
rate_typevaluesTBEorGOODS. Optionalebooksandenewspapersfilters are also documented. IP-based checks return a geolocation confidence score, so decide in advance how your application will act on lower-confidence results instead of re-querying them.
Handle HTTP 429 without spinning
A 429 means you have sent too many requests. Retrying immediately adds load and makes the next 429 more likely. Use this sequence in your client:
- Stop issuing new calls to that API from the affected application. HMRC’s guidance is to pause briefly before retrying. Use a short pause rather than an immediate retry.
- Retry with a bounded delay. For example, wait 1 second, then 2, then 4, and stop after a small fixed number of attempts. Add random jitter so that many workers do not retry at the same moment. These values are an illustrative pattern, not a provider requirement.
- Reduce your rate in the queue. For VAT API v2, the provider’s first suggestion is to lower requests per minute. Put a limiter in front of the client so that bursts are smoothed out.
- Check for duplicate or looping calls. Repeated calls to the same resource or dataset are a common cause of throttling. Log every outgoing request with its path and parameters, then look for identical requests within a short window.
- Surface a clear failure if retries are exhausted. Show users a “try again later” state or queue the work. Do not let a background job keep retrying indefinitely.
Handle other errors by class
Retrying every failure in the same way wastes quota and hides bugs. Treat each status code according to what caused it:
| Status | Documented meaning (VAT API v2) | Recommended handling |
|---|---|---|
| 400 | Invalid request | Do not retry unchanged. Fix the parameters and log the payload that failed. |
| 403 | Authorization problem | Do not retry. Check the x-api-key value, the region, and the plan’s access. |
| 404 | Missing resource | Do not retry. Verify the path and the value being looked up. |
| 429 | Too many requests | Pause and retry with bounded backoff, as described above. |
| 500 | Server error | Retry cautiously with backoff, because the condition may be temporary. |
The provider’s documentation lists these classes; the advice about retry behavior is the standard approach for each one.
Reduce request volume with caching and deduplication
Neither provider presents caching as a feature you can rely on, so implement it in your own application layer.
- Cache responses where freshness allows. VAT rates change infrequently compared with how often a page or checkout may request them, so a short time-to-live can remove most repeat calls. Choose the time-to-live based on how quickly a stale value would cause a wrong calculation. Define it per endpoint and per input.
- Deduplicate concurrent identical requests. If ten workers ask for the same country code at the same moment, send one upstream request and share the result. This is often the single largest reduction in call volume.
- Do not assume batching is safer. HMRC states that its rate limits are designed for real-time interaction and advises developers to avoid batching if they want to avoid rate limiting. Test any change to call grouping against the applicable limit before deploying it.
If the integration is HMRC VAT MTD
HMRC’s end-to-end service guide, updated 23 June 2026, sets out the work required before a product can go live. The minimum functionality covers retrieving VAT obligations and submitting a VAT return, and the product must send fraud-prevention header data with its requests. The guide describes testing the required endpoints in HMRC’s sandbox and then completing the production approval steps.
The guide also lists optional endpoints for customer information, returns, liabilities, payments and penalties. It recommends using the APIs efficiently to prevent hitting the rate limit and handling the documented error responses so your software can recover from exceptions. Those requirements apply only to HMRC’s service and do not transfer to the commercial VAT API.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you are deciding whether to build filing functionality or use existing software, the guide also covers HMRC’s list of compatible software and the requirements for VAT MTD products. Read the current version at developer.service.gov.uk before you commit to a design.
Troubleshooting checklist
- Confirm which service the failing request calls and whether its 429 guidance is the one you are applying.
- Check the plan allowance for VAT API v2 in your account, and compare it with the request count from your logs.
- Search your logs for identical requests made within the same second or minute.
- Verify that retries wait before resending and that they stop after a fixed number of attempts.
- Confirm that 400, 403 and 404 responses are not being retried.
- For HMRC, confirm that the application is sending the required fraud-prevention header data and that it is not batching real-time calls.
- If HMRC’s limit is reached repeatedly even after these changes, contact HMRC about the application design, as its reference guide advises.
Limits, plan terms and HMRC procedures can change. Before you set production numbers, check the current provider documentation and your account dashboard, then test your retry and caching behavior in a non-production environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
