Rate-limit API calls from HubSpot workflows

1. Identify the limit you are actually protecting

Write down the provider, account, credential, endpoint, allowance, time window, and whether the cap is shared. A limit of 100 requests per minute is not enough information if another workflow, app, or human-triggered process consumes the same credential.

Count requests, not records. One workflow record may generate several calls because it looks up data, writes an update, and polls for a result. Multiply enrolled records by calls per record before choosing a release rate.

• Confirm whether limits are per token, app, user, account, endpoint, or IP address.
• Separate burst limits from hourly or daily quotas.
• Reserve capacity for other callers and apply a safety margin.
• Check whether retries count against the same allowance.

2. Put the queue before the sensitive action

The throttle belongs immediately before the call or action that consumes capacity. Records can continue through earlier workflow steps at normal speed, wait in the queue, and leave only when a safe slot is available.

For one workflow, a per-workflow queue is usually enough. If two or more workflows call the same provider account, use one named shared queue so the combined traffic remains under a single cap.

3. Design retries as part of the queue

Treat a 429 as a scheduling signal, not a reason to fire the same request again immediately. Honour Retry-After, apply exponential backoff with jitter, and keep retrying records in a visible state. Make write operations idempotent so delayed or repeated delivery does not duplicate side effects.

Separate permanent failures such as invalid credentials or malformed requests from temporary 429 and 5xx responses. Permanent failures need a review path; retryable failures need a next-attempt time and a maximum age or attempt count.

4. Monitor the system, not just the action

Track queue depth, oldest queued record, releases per window, 429 rate, retry count, dead-letter volume, and end-to-end completion time. Queue depth alone can look healthy while the oldest urgent record waits too long.

Begin below the theoretical maximum, run a representative batch, and increase gradually. The safe rate is the rate that remains reliable alongside every other caller, not the largest number accepted once in a quiet test.

Official sources

Limits and platform behaviour can change. These primary sources were checked on 17 August 2026.

• HubSpot API error handling — Official guidance for 429 responses and workflow action retries.
• HubSpot workflow webhooks — Native webhook action rate controls and retry behaviour.