Cato plans to introduce a new API gateway on December 1, 2026, to improve API performance and provide additional API responses with information to help you optimize your integrations. This infrastructure update also changes how Cato API rate limiting works.
IMPORTANT: This is not a breaking change. There is no degradation to your existing integrations, and no action is required.
What Are the Benefits of the New API Gateway?
The new gateway gives you more flexibility to use your account’s API capacity and provides guidance to help your integrations handle rate limiting. Based on tests, we do not expect performance degradation for your current API usage.
How Rate Limiting Changes
Currently, Cato applies a separate rate limit to each API query or mutation, expressed as a number of calls per time interval. All API keys accessing the same account share the limit for that operation.
The new model uses points-based budgets:
Each operation has a cost in points, which can vary depending on the data you request
Operations consume points from a shared account budget, with additional budgets for specific operations
Budgets replenish over time
API Responses and Retry Guidance
Rate-limited requests return HTTP status code 429 with a reason that helps your integration determine how to proceed:
BUDGET_EXHAUSTED: The available budget is temporarily insufficient. TheRetry-Afterheader andretryAfterextension field indicate how many seconds to wait before retryingREQUEST_EXCEEDS_CAPACITY: Simplify or split the request, because the request is so large, waiting and retrying will not help
The gateway accepts or rejects the entire request rather than partially executing fields that fit within the available budget.
You can also request optional extensions.rateLimit response details containing cost and retryAfter. These details help you understand a request’s point cost and determine when to retry. Retry timing does not reserve capacity, so other requests using the same budget can impact your next attempt.
What Action Do I Need to Take?
No action is required. This is not a breaking change. Your existing integrations, including their rate limiting detection, will continue to work.
After the update, you can optionally use the additional response information to optimize how your integrations handle rate limiting.
For More Information
See FAQ: Upcoming API Gateway and Rate Limiting Changes.
Please use the Cato Ask AI agent in the CMA for questions about API rate limiting. Take me to the CMA AI Workspace.