This page covers a number of broad concepts and requirements that apply to all requests made to the First AML Public API. Following these guidelines will help ensure your integration remains reliable and performant.
Required headers
All requests to the API must include a User-Agent header. Requests without a User-Agent header will be blocked by the firewall and receive a 403 Forbidden response.
We recommend setting a User-Agent that identifies your integration, for example the name of your product and a contact point. This helps us support you if we identify any issues with traffic coming from your integration.
All authenticated requests must also include an Authorization header containing a valid bearer token. See Tokens for details on how to request and use an access token.
Rate limiting
To ensure the ongoing stability and reliability of the Public API for all of our integration partners, requests are subject to rate limiting.
The API enforces a limit of 300 requests per 5 minute sliding window. When you exceed this limit, further requests will receive a 429 Too Many Requests response until the sliding window allows additional requests.
Rate limiting takes effect in the Sandbox environment on August 17th 2026 and in Production environments on August 31st 2026.
Handling rate limits
If you receive a 429 Too Many Requests response, your integration should:
- Stop sending further requests until the sliding window allows them.
- Retry the request after a short delay, ideally using an exponential backoff strategy.
- Avoid retrying immediately in a tight loop, as this will continue to hit the limit.
Staying within the limit
To reduce the likelihood of hitting the rate limit:
- Take advantage of GraphQL to retrieve all the data you need in as few requests as possible, rather than making many small requests.
- Prefer responding to webhooks over frequently polling the API for changes.
- Spread bulk operations, such as creating many cases, over time rather than sending them all at once.
Environments
The API is available in separate Sandbox and Production environments. We recommend developing and testing your integration against Sandbox before switching to Production. See Environments for the full list of connection details.
