Rate Limits

Per-tier request and connection limits for REST and WebSocket clients.

XO enforces per-connection and per-action limits. Order placement and cancellation share the same budget within each order mode; the listed limits do not stack.

Tier / Action	Limit
Public REST requests	5 requests per second
Public WebSocket connections	3 concurrent connections
Authenticated single order placement + cancellation	250 requests per second total
Authenticated batch order placement + cancellation	25 requests per second total
Authenticated batch cancel all	5 requests per second
Authenticated WebSocket connections	25 concurrent connections

WebSocket connection limits

In addition to the per-tier connection caps above, each WebSocket connection has the following ceilings:

Limit	Value
Idle timeout	60 seconds
Inbound message rate	100 messages/sec
Max message size	65 KB
Max subscriptions	100 markets

Send the literal text frame PING to reset the idle timer; the server replies with PONG.

Client guidance

• Throttle on the client. The server will reject excess traffic without backoff hints.
• Keep order placement and cancellation in separate queues so a cancellation burst can’t starve placements.
• Share a single WebSocket connection across strategies rather than reconnecting on every restart — the connection cap is the binding constraint long before the request cap is.
• Use GET /time to keep clocks aligned. L2 HMAC requests fail if XO_TIMESTAMP drifts more than ±30 s from server time.