---
# === IDENTITY ===
id: business/erp-integration/erp-rate-limits-comparison/2026
canonical_question: "How do API rate limits and throttling compare across Salesforce, SAP, Oracle, NetSuite, Dynamics 365, Workday?"
aliases:
  - "ERP API rate limits comparison table"
  - "Which ERP has the highest API call limits?"
  - "Salesforce vs SAP vs Oracle vs NetSuite API throttling"
  - "ERP integration rate limit planning guide"
entity_type: erp_integration
domain: business > erp-integration > erp-rate-limits-comparison
region: global
jurisdiction: global
temporal_scope: 2025-2026

# === SYSTEM PROFILE ===
systems:
  - name: "Salesforce"
    vendor: "Salesforce"
    version: "API v62.0"
    edition: "Enterprise, Unlimited, Developer"
    deployment: "cloud"
    api_surface: "REST, SOAP, Bulk API 2.0, Streaming"
  - name: "SAP S/4HANA Cloud"
    vendor: "SAP"
    version: "2408"
    edition: "Public Cloud, Private Cloud"
    deployment: "cloud"
    api_surface: "OData v2/v4, SOAP, RFC"
  - name: "Oracle Fusion Cloud ERP"
    vendor: "Oracle"
    version: "Release 24D"
    edition: "Standard"
    deployment: "cloud"
    api_surface: "REST, SOAP, FBDI, BI Publisher"
  - name: "Oracle NetSuite"
    vendor: "Oracle"
    version: "2024.2"
    edition: "Standard, Premium, Enterprise, Ultimate"
    deployment: "cloud"
    api_surface: "REST, SuiteTalk SOAP, RESTlets, SuiteQL"
  - name: "Microsoft Dynamics 365 Finance & Operations"
    vendor: "Microsoft"
    version: "10.0.40"
    edition: "Finance, Supply Chain Management"
    deployment: "cloud"
    api_surface: "OData v4, Custom Services, Data Management Framework"
  - name: "Workday"
    vendor: "Workday"
    version: "2024 R2"
    edition: "Standard"
    deployment: "cloud"
    api_surface: "REST, SOAP, RaaS, WQL"

# === VERIFICATION ===
last_verified: 2026-03-02
confidence: 0.85
version: 1.0
first_published: 2026-03-02

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "2025-10 — Salesforce API v62.0; Dynamics 365 removed mandatory user-based limits in 10.0.36"
  next_review: 2026-08-29
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Salesforce: 100,000 base API calls/24h for Enterprise — drops to 15,000 for Developer Edition"
  - "NetSuite: Concurrency pool shared across REST, SOAP, RESTlets, and SuiteQL — all compete for the same slots"
  - "Oracle Fusion: REST API returns max 499 records per GET request — no override available"
  - "Dynamics 365 F&O: User-based limits are per-user per-app-ID per-web-server — not per-org"
  - "Workday: Rate limits are not publicly documented — must consult Workday support for tenant-specific thresholds"
  - "SAP S/4HANA Cloud: No built-in API-level rate limiting — throttling is infrastructure-dependent via API Management or Web Dispatcher"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs detailed single-system API capabilities, not a comparison"
    use_instead: "business/erp-integration/{system}-api-capabilities/2026"
  - condition: "User needs authentication flow comparison"
    use_instead: "business/erp-integration/erp-authentication-comparison/2026"
  - condition: "User needs bulk import comparison"
    use_instead: "business/erp-integration/erp-bulk-import-comparison/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: integration_pattern
    question: "What integration pattern do you need?"
    type: choice
    options:
      - "real-time sync (individual records, <1s latency)"
      - "batch/bulk (scheduled, high volume)"
      - "event-driven (webhook, CDC, platform events)"
      - "file-based (CSV/XML import/export)"
  - key: data_volume
    question: "What's your daily data volume?"
    type: choice
    options:
      - "< 1,000 records/day"
      - "1,000-100,000 records/day"
      - "> 100,000 records/day"
  - key: direction
    question: "What's the data flow direction?"
    type: choice
    options:
      - "inbound (writing to this ERP)"
      - "outbound (reading from this ERP)"
      - "bidirectional sync"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/business/erp-integration/erp-rate-limits-comparison/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-02)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  related_to:
    - id: "business/erp-integration/erp-authentication-comparison/2026"
      label: "ERP authentication flow comparison"
    - id: "business/erp-integration/erp-rest-api-comparison/2026"
      label: "ERP REST API capabilities comparison"
    - id: "business/erp-integration/erp-bulk-import-comparison/2026"
      label: "ERP bulk import comparison"
  solves: []
  alternative_to: []
  often_confused_with:
    - id: "business/erp-integration/erp-rest-api-comparison/2026"
      label: "REST API comparison covers capabilities; this card covers limits and throttling"

# === SOURCES ===
sources:
  - id: src1
    title: "API Request Limits and Allocations — Salesforce Developer Limits Quick Reference"
    author: Salesforce
    url: https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm
    type: official_docs
    published: 2025-11-01
    reliability: authoritative
  - id: src2
    title: "Service Protection API Limits — Dynamics 365 Finance & Operations"
    author: Microsoft
    url: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/data-entities/service-protection-api-limits
    type: official_docs
    published: 2026-01-20
    reliability: authoritative
  - id: src3
    title: "NetSuite API Governance: Concurrency & Rate Limits Explained"
    author: Houseblend
    url: https://www.houseblend.io/articles/netsuite-api-governance-guide
    type: technical_blog
    published: 2025-06-15
    reliability: moderate_high
  - id: src4
    title: "Requests Limits and Allocations — Power Platform / Dataverse"
    author: Microsoft
    url: https://learn.microsoft.com/en-us/power-platform/admin/api-request-limits-allocations
    type: official_docs
    published: 2025-09-24
    reliability: authoritative
  - id: src5
    title: "SAP S/4HANA API Throttling and Rate Limits — SAP Community"
    author: SAP Community
    url: https://community.sap.com/t5/technology-q-a/sap-s4-hana-api-throttling-and-rate-limits/qaq-p/12779925
    type: community_resource
    published: 2024-11-01
    reliability: moderate
  - id: src6
    title: "Oracle Fusion Cloud ERP REST API — Max Limit Parameter"
    author: Oracle
    url: https://support.oracle.com/knowledge/Oracle%20Fusion%20Applications/2429019_1.html
    type: official_docs
    published: 2024-06-01
    reliability: authoritative
  - id: src7
    title: "Workday API Integration In-Depth Guide"
    author: Knit
    url: https://www.getknit.dev/blog/workday-api-integration-in-depth
    type: technical_blog
    published: 2025-03-15
    reliability: moderate_high
  - id: src8
    title: "NetSuite Concurrency Governance — Oracle Official Docs"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_164095787873.html
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
---

# ERP API Rate Limits Comparison: Salesforce vs SAP vs Oracle vs NetSuite vs Dynamics 365 vs Workday (2026)

## TL;DR

- **Bottom line**: Rate limit architectures vary dramatically — Salesforce uses hard daily quotas by edition, NetSuite governs by concurrency slots, Dynamics 365 F&O throttles on server resource utilization, SAP delegates to infrastructure, Oracle Fusion caps per-request records, and Workday limits are largely undocumented.
- **Key limit**: Salesforce Enterprise is the most explicit at 100,000 API calls/24h base + 1,000/user license; all others use some form of fair-use or resource-based throttling.
- **Watch out for**: NetSuite's concurrency pool is shared across ALL API types (REST, SOAP, RESTlets, SuiteQL) — a heavy SOAP integration can starve REST calls in the same account.
- **Best for**: Planning integration architecture, capacity planning, and selecting the right ERP API surface for your data volume.
- **Authentication**: All six systems support OAuth 2.0; rate limits are typically tracked per authenticated user or service principal, not per endpoint.

## System Profile

This card compares API rate limits, throttling mechanisms, and governance models across the six most common enterprise ERP platforms as of early 2026. It covers cloud deployments only — on-premise SAP and Dynamics have different (or no) API throttling models.

| System | Role | API Surface | Rate Limit Model |
|---|---|---|---|
| Salesforce | CRM + Platform | REST, SOAP, Bulk API 2.0, Streaming | Hard daily quota by edition |
| SAP S/4HANA Cloud | ERP | OData v2/v4, SOAP, RFC | Infrastructure-level (API Management) |
| Oracle Fusion Cloud ERP | ERP | REST, SOAP, FBDI, BI Publisher | Per-request record cap + fair-use |
| Oracle NetSuite | ERP | REST, SuiteTalk SOAP, RESTlets, SuiteQL | Concurrency slots + rate windows |
| Dynamics 365 F&O | ERP | OData v4, Custom Services, DMF | Resource-based + optional user-based |
| Workday | HCM + Financials | REST, SOAP, RaaS, WQL | Undocumented / per-tenant |

## API Surfaces & Capabilities

| API Surface | Protocol | Best For | Max Records/Request | Rate Limit | Real-time? | Bulk? |
|---|---|---|---|---|---|---|
| Salesforce REST | HTTPS/JSON | Individual CRUD, <2K records | 2,000 per query page | 100K calls/24h (Enterprise) | Yes | No |
| Salesforce Bulk API 2.0 | HTTPS/CSV | Data migration, >2K records | 150M per file | 15,000 batches/24h | No | Yes |
| SAP OData v4 | HTTPS/JSON | Standard CRUD, queries | Configurable (default 100, $top supported) | Infrastructure-dependent | Yes | Via $batch |
| Oracle Fusion REST | HTTPS/JSON | Standard CRUD, queries | 499 per GET request | Fair-use / not published | Yes | No |
| Oracle Fusion FBDI | File-based/CSV | Bulk data loading | Unlimited (file-based) | Scheduled job queue | No | Yes |
| NetSuite REST | HTTPS/JSON | Individual CRUD | 1,000 per query | Concurrency-governed | Yes | No |
| NetSuite SuiteTalk SOAP | HTTPS/XML | Bulk operations, search | 1,000 per search page | Shared concurrency pool | Yes | Partial |
| Dynamics 365 OData | HTTPS/JSON | Standard CRUD, queries | 5,000 per page (configurable) | 6,000 req/5min/user/server | Yes | Via $batch |
| Dynamics 365 DMF | File-based | Bulk data import/export | Unlimited (file-based) | Exempt from API limits | No | Yes |
| Workday REST | HTTPS/JSON | Individual CRUD | 100 default page size | Not publicly documented | Yes | No |
| Workday RaaS | HTTPS/JSON,CSV,XML | Report extraction | Up to 2GB per report | Not publicly documented | No | Yes |

## Rate Limits & Quotas

### Per-Request Limits

| System | Limit Type | Value | Notes |
|---|---|---|---|
| Salesforce | Max records per REST query page | 2,000 | Use queryMore/nextRecordsUrl for pagination [src1] |
| Salesforce | Max composite subrequests | 25 | All-or-nothing by default [src1] |
| Salesforce | Max request body size | 50 MB | REST API [src1] |
| Salesforce | Max Bulk API file size | 150 MB | Per Bulk API 2.0 job [src1] |
| Oracle Fusion | Max records per GET | 499 | Hard limit, cannot be overridden [src6] |
| Oracle Fusion | Max records per POST | 500 | Recommended maximum [src6] |
| NetSuite | Max objects per query | 1,000 | REST defaults to 100 if unspecified [src3] |
| NetSuite | Max SuiteQL rows | 100,000 | Per single query [src3] |
| Dynamics 365 F&O | Max concurrent requests per user | 52 | Per user, per app ID, per web server [src2] |
| Dynamics 365 Dataverse | Max records per page | 5,000 | OData $top parameter [src4] |
| SAP S/4HANA | Default page size | 100 | Configurable via $top; no hard maximum documented [src5] |
| Workday | Default page size | 100-500 | Varies by endpoint; 200-500 recommended [src7] |

### Rolling / Daily Limits

| System | Limit Type | Value | Window | Edition / License Differences |
|---|---|---|---|---|
| Salesforce | Total API calls | 100,000 base | 24h rolling | Enterprise: 100K + 1,000/user; Unlimited: 5M; Developer: 15,000; Performance: 5M [src1] |
| Salesforce | Bulk API batches | 15,000 | 24h rolling | Shared across all editions [src1] |
| Salesforce | Streaming events | 200,000 | 24h | Higher with add-on licenses [src1] |
| Salesforce | Concurrent long-running requests | 25 (prod), 5 (dev) | Per org | Requests running >20 seconds [src1] |
| Dynamics 365 F&O | Requests per user per server | 6,000 | 5-min sliding window | Per user, per app ID, per web server [src2] |
| Dynamics 365 F&O | Execution time per user per server | 1,200 seconds | 5-min sliding window | Combined execution time [src2] |
| Dynamics 365 Dataverse | Licensed user requests | 40,000 | 24h | D365 Enterprise/Professional; Team Member: 6,000 [src4] |
| Dynamics 365 Dataverse | Non-licensed user pool | 500,000 base + 5,000/license | 24h | Tenant-level, shared across service principals; max 10M [src4] |
| NetSuite | Concurrent requests | 5-20 base | Rolling | Standard: 5; Premium: 15; Enterprise/Ultimate: 20; +10 per SuiteCloud Plus license [src3, src8] |
| NetSuite | Per-user RESTlet concurrency | 5 | Rolling | Hard cap regardless of tier [src3] |
| Oracle Fusion | REST API calls | Not published | Fair-use | Oracle does not publish hard daily limits; throttles via 429 responses [src6] |
| SAP S/4HANA Cloud | API calls | Not published | Fair-use | Managed via API Management policies or Web Dispatcher; no built-in limits [src5] |
| Workday | API calls | Not published | Unknown | Tenant-specific; must contact Workday support for thresholds [src7] |

### Transaction / Governor Limits

These limits are unique to platforms with multi-tenant transaction architectures. Salesforce and NetSuite are the most restrictive.

| System | Limit Type | Per-Transaction Value | Notes |
|---|---|---|---|
| Salesforce | SOQL queries | 100 sync / 200 async | Includes queries from triggers — cascading triggers consume from same pool [src1] |
| Salesforce | DML statements | 150 sync / 300 async | Each insert/update/delete counts as 1 [src1] |
| Salesforce | DML records processed | 10,000 | Per transaction [src1] |
| Salesforce | CPU time | 10,000 ms sync / 60,000 ms async | Exceeded = transaction abort [src1] |
| Salesforce | Heap size | 6 MB sync / 12 MB async | Exceeded = transaction abort [src1] |
| Salesforce | Callouts (HTTP) | 100 | Per Apex transaction [src1] |
| Salesforce | SOQL records retrieved | 50,000 | Per transaction [src1] |
| NetSuite | Governance units per script | Varies by script type | SuiteScript 2.0: units consumed vary per API call (e.g., search = 10 units, record load = 5 units) [src3] |
| Dynamics 365 F&O | Execution time per request | Part of 1,200s combined pool | Tracked in 5-min window [src2] |

## Authentication

| System | Primary Auth Flow | Rate Limit Tracking | Token Lifetime | Notes |
|---|---|---|---|---|
| Salesforce | OAuth 2.0 JWT Bearer | Per org (daily) + per user (governor) | 2h default session | Connected app required; limits tracked at org level [src1] |
| SAP S/4HANA | OAuth 2.0 / X.509 / Basic | Per infrastructure policy | Configurable | SAP API Management handles throttling, not S/4HANA itself [src5] |
| Oracle Fusion | OAuth 2.0 / Basic Auth | Per tenant (fair-use) | Configurable | JWT bearer supported for server-to-server [src6] |
| NetSuite | Token-Based Auth (TBA) + OAuth 2.0 | Per account (concurrency) | Token: no expiry; OAuth: configurable | TBA tokens don't expire but can be revoked [src3, src8] |
| Dynamics 365 F&O | OAuth 2.0 (Entra ID) | Per user + per app ID + per web server | Entra token: 1h default | Service principals tracked against non-licensed pool [src2, src4] |
| Workday | OAuth 2.0 / WS-Security | Per tenant | Configurable | Rate limits tied to integration system user [src7] |

### Authentication Gotchas

- Salesforce: API calls from Apex triggers inside a transaction count against governor limits, NOT the daily API limit — these are separate quota pools. [src1]
- Dynamics 365: Each web server independently tracks the 6,000 req/5-min limit. With multiple servers, your actual limit is 6,000 x N web servers, but you can't control which server receives your request. [src2]
- NetSuite: All API types (REST, SOAP, RESTlets, SuiteQL) share the SAME concurrency pool. A single heavy SOAP integration can block REST calls for the entire account. [src3]

## Constraints
<!-- Agents: read this section before recommending any integration approach from this unit.
     These are hard constraints that must not be violated. -->

- **Salesforce edition lock-in**: Developer Edition has only 15,000 API calls/24h — load testing on Developer orgs does NOT reflect production capacity (100,000+ for Enterprise). Always test with a sandbox from your actual edition. [src1]
- **NetSuite shared concurrency**: All API types share concurrency slots. A burst of SOAP requests will block REST and RESTlet calls. Design integrations to reserve dedicated concurrency allocations per integration record. [src3, src8]
- **Oracle Fusion 499-record wall**: REST API GET requests return a maximum of 499 records regardless of the limit parameter value. Pagination is mandatory for any dataset. Use FBDI for bulk operations. [src6]
- **Dynamics 365 resource-based throttling**: Even if user-based limits aren't hit, resource-based limits can throttle when aggregate server CPU/memory exceeds thresholds. This is non-deterministic and varies by time of day. [src2]
- **SAP no built-in limits**: SAP S/4HANA Cloud has no API-level rate limiting — this is both a feature and a risk. Without API Management, a runaway integration can destabilize the entire tenant. [src5]
- **Workday opacity**: Workday does not publish comprehensive rate limits. Integrations must implement defensive retry logic because you won't know your limits until you hit them. [src7]
- **Dynamics 365 Dataverse daily limits stack**: If a user has multiple D365 licenses, their daily request limits ADD together (e.g., D365 CE Enterprise + Power Apps per user = 80,000 requests/day). [src4]

## Integration Pattern Decision Tree

```
START -- Which ERP system are you integrating with?
|
+-- Salesforce
|   +-- < 2,000 records/operation? --> REST API (100K calls/24h)
|   +-- > 2,000 records? --> Bulk API 2.0 (15K batches/24h, 150MB/file)
|   +-- Need real-time events? --> Platform Events / CDC (200K events/24h)
|   +-- Governor limits concern? --> Batch Apex (async: 200 SOQL, 60s CPU)
|
+-- SAP S/4HANA Cloud
|   +-- Standard CRUD? --> OData v4 (no hard rate limit)
|   +-- Bulk data? --> $batch requests or IDoc/BAPI
|   +-- Need throttling? --> Deploy SAP API Management layer
|
+-- Oracle Fusion Cloud
|   +-- < 500 records? --> REST API (499 max per GET)
|   +-- > 500 records read? --> REST with offset pagination loops
|   +-- Bulk import? --> FBDI (file-based, no API limit)
|   +-- Bulk extract? --> BI Publisher reports / BIP
|
+-- NetSuite
|   +-- < 1,000 records? --> REST API or SuiteQL
|   +-- Concurrency concern? --> Reserve slots via Integration Records
|   +-- Bulk operations? --> SuiteTalk SOAP with saved searches
|   +-- Need real-time? --> RESTlets (5 concurrent per user max)
|
+-- Dynamics 365 F&O
|   +-- Standard CRUD? --> OData v4 (6,000 req/5min/user/server)
|   +-- Bulk import/export? --> DMF (exempt from API limits)
|   +-- High volume real-time? --> Dual Write or Virtual Entities
|   +-- Dataverse (CE)? --> 40,000 req/24h per licensed user
|
+-- Workday
    +-- Standard CRUD? --> REST API (limits undocumented)
    +-- Report extraction? --> RaaS (up to 2GB per report)
    +-- Bulk query? --> WQL (Workday Query Language)
    +-- Always implement --> Retry logic with exponential backoff
```

## Quick Reference

| Capability | Salesforce | SAP S/4HANA | Oracle Fusion | NetSuite | Dynamics 365 F&O | Workday |
|---|---|---|---|---|---|---|
| **Daily API limit** | 100K-5M (by edition) | Not published | Not published | Not published | 6K/5min/user/server | Not published |
| **Concurrency limit** | 25 long-running | Infrastructure | Not published | 5-20 base slots | 52/user/server | Not published |
| **Max records/GET** | 2,000 | Configurable | 499 | 1,000 | 5,000 | 100-500 |
| **Bulk mechanism** | Bulk API 2.0 (150MB) | $batch / IDoc | FBDI (file) | SuiteTalk lists | DMF (file, exempt) | RaaS (2GB) |
| **Throttle response** | HTTP 429 | Depends on infra | HTTP 429 | HTTP 429 (REST) / 403 (SOAP) | HTTP 429 | HTTP 429 |
| **Retry-After header** | Yes | Depends | Not guaranteed | Not guaranteed | Yes | Not documented |
| **Governor/transaction limits** | Yes (extensive) | No | No | Yes (governance units) | Execution time pool | No |
| **Limit transparency** | Excellent | Low | Low | Good | Good | Poor |
| **Limit configurability** | Buy add-ons only | Full (via API Mgmt) | None | Buy SuiteCloud Plus | Buy capacity add-ons | Contact support |
| **Sandbox limits** | Lower than production | Same as production | Same as production | Lower (dev acct = 5 slots) | Same (1 web server in trial) | Same as production |

## Error Handling & Failure Points

### Common Error Codes

| System | Code | Meaning | Cause | Resolution |
|---|---|---|---|---|
| Salesforce | REQUEST_LIMIT_EXCEEDED | Daily API limit hit | Exceeded 24h rolling quota | Wait for rolling window reset or purchase add-on API calls [src1] |
| Salesforce | GOVERNOR_LIMIT | Transaction limit exceeded | Too many SOQL/DML in one transaction | Bulkify code; use async processing [src1] |
| NetSuite | 429 Too Many Requests | Concurrency/rate exceeded | All concurrency slots occupied | Exponential backoff; reserve dedicated slots [src3] |
| NetSuite | SSS_REQUEST_LIMIT_EXCEEDED | RESTlet rate limit | Per-user RESTlet concurrency exceeded | Reduce parallel RESTlet calls; max 5 per user [src3] |
| Dynamics 365 | 429 Too Many Requests | Service protection triggered | 6,000 requests in 5-min window OR resource threshold OR 1,200s execution time | Respect Retry-After header; distribute across time [src2] |
| Oracle Fusion | 429 Too Many Requests | Fair-use throttle triggered | Sustained high request volume | Implement backoff; switch to FBDI for bulk [src6] |
| Workday | 429 Too Many Requests | Rate limit exceeded | Exceeded tenant-specific threshold | Implement exponential backoff with jitter [src7] |

### Failure Points in Production

- **Salesforce: Sandbox gives false confidence on limits**: Developer/sandbox orgs have 15,000 API calls/24h vs 100,000+ in Enterprise production. Load tests pass in sandbox, then fail in prod when actual traffic is added. Fix: `Test against a full-copy sandbox provisioned from your actual production edition.` [src1]
- **NetSuite: SOAP integration starves REST calls**: Heavy SOAP XML payloads hold concurrency slots longer than lightweight REST calls, blocking the entire account. Fix: `Reserve dedicated concurrency per integration record; migrate SOAP to REST where possible.` [src3]
- **Dynamics 365: Multi-server limit confusion**: The 6,000 req/5-min limit is per web server, and requests are load-balanced across servers. You can't predict which server handles your request, so you can't simply multiply by server count. Fix: `Start at 1,200 req/min and increase until 429 errors appear, then use Retry-After intervals.` [src2]
- **Oracle Fusion: Silent pagination failure**: If you set limit=1000 in a GET request, the API silently returns only 499 records without error. Fix: `Always check the hasMore attribute in responses; loop with offset pagination.` [src6]
- **SAP: No limits until everything breaks**: Without API Management, S/4HANA Cloud has no rate limiting. A runaway batch job can consume all dialog work processes and bring down the tenant. Fix: `Deploy SAP API Management with spike arrest and quota policies before any integration goes to production.` [src5]
- **Workday: Undocumented limits cause surprise failures**: Integrations that work in testing hit undiscovered rate limits at production scale. Fix: `Always implement retry with exponential backoff; contact Workday support for tenant-specific limits before go-live.` [src7]

## Anti-Patterns

### Wrong: Assuming all ERPs have the same rate limit model

```
// BAD -- treating all ERPs like Salesforce with a single daily counter
const MAX_DAILY_CALLS = 100000; // This is Salesforce-specific!
let callCount = 0;

async function callErpApi(erpSystem, endpoint) {
  if (callCount >= MAX_DAILY_CALLS) {
    await waitForReset();
  }
  callCount++;
  return fetch(endpoint);
}
```

### Correct: System-specific rate limit handling

```
// GOOD -- each ERP has its own throttling model
const rateLimitStrategies = {
  salesforce: { type: 'daily_quota', limit: 100000, window: '24h' },
  netsuite:   { type: 'concurrency', maxSlots: 15, retryOn: [429, 403] },
  dynamics365: { type: 'sliding_window', limit: 6000, window: '300s' },
  oracle_fusion: { type: 'fair_use', retryOn: [429] },
  sap:        { type: 'infrastructure', managed: 'api_management' },
  workday:    { type: 'undocumented', retryOn: [429] },
};

async function callErpApi(erpSystem, endpoint) {
  const strategy = rateLimitStrategies[erpSystem];
  try {
    return await fetchWithRetry(endpoint, strategy);
  } catch (e) {
    if (strategy.retryOn?.includes(e.status)) {
      const retryAfter = e.headers?.get('Retry-After') || 5;
      await sleep(retryAfter * 1000);
      return callErpApi(erpSystem, endpoint);
    }
    throw e;
  }
}
```

### Wrong: Using REST API for bulk data in Oracle Fusion

```
// BAD -- looping REST calls to import 10,000 records (499 max per request)
for (let offset = 0; offset < 10000; offset += 499) {
  await fetch(`/fscmRestApi/resources/v1/invoices?limit=499&offset=${offset}`);
  // 21 API calls minimum, each potentially throttled
}
```

### Correct: Use FBDI for bulk operations in Oracle Fusion

```
// GOOD -- use File-Based Data Import for bulk operations
// 1. Generate CSV file conforming to FBDI template
// 2. Upload via UCM (Universal Content Management)
// 3. Submit scheduled ESS job for processing
const fbdiPayload = {
  OperationName: "importBulkData",
  DocumentContent: base64EncodedCsv,
  ContentType: "text/csv",
  DocumentAccount: "fin$/journal$/import$"
};
await fetch('/fscmRestApi/resources/v1/erpintegrations', {
  method: 'POST',
  body: JSON.stringify(fbdiPayload)
});
```

### Wrong: Not reserving NetSuite concurrency slots

```
// BAD -- all integrations compete for the same pool
// Integration A: SOAP sync (holds slots for 5-10s per request)
// Integration B: REST real-time (needs <1s responses)
// Integration C: RESTlet webhooks (blocked by A and B)
// Result: Integration C gets 429 errors during peak hours
```

### Correct: Reserve dedicated concurrency per integration

```
// GOOD -- allocate slots via NetSuite Integration Records
// Setup > Integration > Integration Management > Integration Governance
// Integration A (SOAP sync): 8 reserved slots
// Integration B (REST real-time): 5 reserved slots
// Integration C (RESTlets): 3 reserved slots
// Unallocated: 1 slot minimum (required by NetSuite)
// Total: 17 slots = Premium tier (15 base + 1 SuiteCloud Plus license)
```

## Common Pitfalls

- **Salesforce: Testing on wrong edition**: Developer Edition has 15,000 API calls/24h while Enterprise has 100,000+ base. Tests pass, production fails. Fix: `Always provision a full-copy sandbox from your production org for integration testing.` [src1]
- **Dynamics 365: Ignoring execution time limit**: The 1,200-second combined execution time in 5 minutes is often hit before the 6,000 request count. Complex queries consume disproportionate time. Fix: `Monitor execution time via Dynamics 365 telemetry; simplify OData queries.` [src2]
- **NetSuite: SuiteCloud Plus math error**: Each SuiteCloud Plus license adds 10 concurrency slots, but developers often forget the base varies by tier (Standard=5, Premium=15, Enterprise=20). Fix: `Check Setup > Integration > Integration Governance for actual account limits.` [src3, src8]
- **Oracle Fusion: Assuming limit parameter works above 499**: Setting limit=1000 silently returns only 499 records. No error, no warning — just missing data. Fix: `Always implement pagination with hasMore attribute checking.` [src6]
- **Cross-platform: Conflating per-org vs per-user limits**: Salesforce limits are per-org; Dynamics 365 limits are per-user-per-server; NetSuite limits are per-account. Fix: `Read this comparison card before designing multi-ERP integrations.`
- **SAP: Going to production without API Management**: SAP S/4HANA Cloud has no built-in throttling. Without SAP API Management or a third-party gateway, there's no protection against runaway integrations. Fix: `Deploy API Management with spike arrest (e.g., 100 req/sec) and daily quota policies before go-live.` [src5]

## Diagnostic Commands

```bash
# === SALESFORCE: Check remaining API quota ===
curl -H "Authorization: Bearer $SF_TOKEN" \
  "https://yourInstance.salesforce.com/services/data/v62.0/limits" \
  | jq '.DailyApiRequests'
# Returns: { "Max": 100000, "Remaining": 87234 }

# === NETSUITE: Check concurrency governance ===
# Navigate to: Setup > Integration > Integration Management > Integration Governance
# Or use SuiteQL:
curl -X POST "https://ACCOUNT_ID.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql" \
  -H "Authorization: OAuth ..." \
  -d '{"q": "SELECT * FROM integrationGovernance"}'

# === DYNAMICS 365 F&O: Monitor throttling via telemetry ===
# Check Lifecycle Services (LCS) > Environment Monitoring > Raw Logs
# Filter for: ThrottledRequests
# Or use Power Platform Admin Center > Analytics > API calls

# === DYNAMICS 365 DATAVERSE: Check daily allocation ===
# Power Platform Admin Center > Licensing > Capacity add-ons > Download reports

# === ORACLE FUSION: Test pagination behavior ===
curl -u "user:pass" \
  "https://your-instance.fa.ocs.oraclecloud.com/fscmRestApi/resources/v1/invoices?limit=499&offset=0" \
  | jq '.hasMore'
# If true, increment offset by 499 and repeat

# === SAP S/4HANA: Check API Management metrics ===
# SAP Integration Suite > API Management > Analyze > API Traffic
# Or via API: GET /apiportal/api/1.0/Management.svc/APIProxyMetrics
```

## Cross-System Comparison

| Capability | Salesforce | SAP S/4HANA | Oracle Fusion | NetSuite | Dynamics 365 F&O | Workday |
|---|---|---|---|---|---|---|
| **Rate Limit Architecture** | Hard daily quota + governor limits | No built-in; infrastructure-managed | Fair-use / undocumented | Concurrency slots + rate windows | Resource-based + sliding window | Undocumented / per-tenant |
| **Daily API Cap** | 100K-5M by edition | Unlimited (without API Mgmt) | Not published | Not published (rate windows) | 6K/5min/user/server (F&O) or 40K/24h/user (Dataverse) | Not published |
| **Concurrency Cap** | 25 long-running | Dialog work processes (configurable) | Not published | 5-20 base + 10/SuiteCloud Plus | 52/user/app/server | Not published |
| **Max Records/GET** | 2,000 | Configurable ($top) | 499 (hard cap) | 1,000 | 5,000 | 100-500 |
| **Bulk API** | Bulk API 2.0 (150MB/file, 15K batches/day) | $batch, IDoc, BAPI | FBDI (file-based, no API limit) | SuiteTalk lists (1,000/page) | DMF (exempt from limits) | RaaS (2GB/report) |
| **Transaction/Governor Limits** | Yes: 100 SOQL, 150 DML, 10K records, 10s CPU | No | No | Yes: governance units per script | Combined execution time pool | No |
| **HTTP 429 + Retry-After** | Yes, both | Depends on API Mgmt config | 429 yes, Retry-After not guaranteed | 429 (REST) / 403 (SOAP) | Yes, both | 429 yes, Retry-After unclear |
| **Limit Transparency** | Excellent (API endpoint) | Low (no standard endpoint) | Low (community-sourced) | Good (admin panel) | Good (admin center + telemetry) | Poor (contact support) |
| **Buy More Capacity** | Purchase API call packs | Scale infrastructure / API Mgmt | Contact Oracle sales | SuiteCloud Plus license (+10 slots) | Capacity add-on packs (+50K/24h) | Contact Workday |
| **Limit Scope** | Per org (daily) / per transaction (governor) | Per tenant (infrastructure) | Per tenant (fair-use) | Per account (concurrency + rate) | Per user + per app + per server | Per tenant |
| **Sandbox Differences** | Lower limits than production | Same as production | Same as production | Developer = 5 concurrent max | Trial = 1 web server | Same as production |

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| Planning integration architecture for multi-ERP environments | Need detailed single-system API reference | System-specific API capability card |
| Capacity planning for a new ERP integration project | Choosing which ERP to buy | business/erp-selection category |
| Debugging rate limit errors across different ERP systems | Need authentication flow details | business/erp-integration/erp-authentication-comparison/2026 |
| Comparing ERP platforms for integration friendliness | Need bulk import specifics | business/erp-integration/erp-bulk-import-comparison/2026 |
| Designing retry/backoff strategy for multi-ERP middleware | Need code-level API tutorials | System-specific API capability card |

## Important Caveats

- Rate limits change with every major release. Salesforce updates limits with each seasonal release (Spring/Summer/Winter); SAP with each quarterly update (e.g., 2408); Dynamics 365 with each 10.0.x version. Always verify against current release notes before designing integrations.
- Salesforce limits vary dramatically by edition — the difference between Developer (15K/day) and Unlimited (5M/day) is 333x. Never extrapolate from one edition to another.
- SAP and Oracle Fusion do not publish hard rate limits. The numbers in this card are derived from official documentation, community resources, and practitioner experience. Your actual thresholds may differ.
- Workday rate limits are the least transparent of all six platforms. The only confirmed per-endpoint limit is 5 req/sec for Strategic Sourcing. All other limits require contacting Workday support.
- Dynamics 365 F&O made user-based limits optional (disabled by default) in version 10.0.36 — resource-based limits remain mandatory. This means throttling is less predictable but still occurs under load. [src2]
- NetSuite concurrency governance was introduced in Release 2017.2 and is now the primary rate limiting mechanism. The exact per-minute and per-day rate limits are not publicly disclosed by Oracle; community estimates suggest thousands per minute for large accounts. [src3]
- Sandbox and developer environments often have lower limits than production (especially Salesforce and NetSuite). Always validate integration capacity in a production-equivalent environment.

## Related Units

- [ERP Authentication Comparison](/business/erp-integration/erp-authentication-comparison/2026)
- [ERP REST API Capabilities Comparison](/business/erp-integration/erp-rest-api-comparison/2026)
- [ERP Bulk Import Comparison](/business/erp-integration/erp-bulk-import-comparison/2026)