Limits
DLP On Demand — Public Cloud enforces the following limits on API traffic. Design your integration to handle these gracefully.
- Rate limit: a default per-tenant request rate limit (requests/second) applies to your traffic. Requests beyond the limit receive an HTTP 429 response with a
Retry-Afterheader — back off and retry after that many seconds. - Volume limit: a default per-tenant data volume limit (aggregated per minute) also applies, independent of the request-rate limit. Exceeding it also returns a 429 with
Retry-After. - Maximum request size: requests exceeding the maximum allowed body size (128 MiB) are rejected with an HTTP 413.
Informational
X-RateLimit-* headers aren’t guaranteed to be present on every response. Rely on the HTTP status code (429/413) and Retry-After, not on those headers, to detect and handle limiting.Troubleshooting
| HTTP Status | Likely Cause | What to Check |
|---|---|---|
| 401 Unauthorized | API key missing, incorrect, or expired/revoked | Confirm the Authorization: Bearer header is present and the key hasn’t been rotated or deleted |
| 403 Forbidden | The service account’s role doesn’t include the DLP On Demand permission, or the request doesn’t match your tenant | Check that the role assigned to your service account includes the DLP On Demand permission |
| 404 Not Found | Incorrect path, unsupported method, or the endpoint isn’t available on your plan | Double-check the request path and HTTP method against the API Reference |
| 413 Payload Too Large | Request body exceeds the maximum allowed size | Reduce the size of the uploaded content, or contact your Netskope representative if you need a higher limit |
| 429 Too Many Requests | Rate or volume limit exceeded | Back off and retry after the number of seconds in the Retry-After header |