SAM.gov API Rate Limits Explained

Updated October 3, 2026

What each SAM.gov API access tier allows per day, who is eligible to ask for more, and what GSA points you to when the quota binds.

Quick summary: Public access: 10 requests/day. Entity registration: 1,000/day. Federal system users: 10,000/day.

Rate Limits by Access Tier

10/day Basic key, issued instantly with a SAM.gov account
1,000/day After entity registration, on either an individual account key once you hold a role with the entity, or a non-federal system account key
10,000/day Federal system account, .gov or .mil

The higher tier does not switch on at approval. Once a role with an entity is granted, the 1,000/day ceiling takes effect 24 hours later (FSD KB0017604), so a key tested immediately after approval still reports the basic quota.

Can You Get the Limit Raised? Only If You Are Federal

This is the part that is rarely written down, and it decides whether the API can carry a commercial workload at all. GSA's guidance is explicit: only federal system account users can request a rate increase. If you are a non-federal user, or you are using an individual account API key, your account is not eligible to be considered for the exception.

So the practical ceiling for a non-federal system account is 1,000 requests per 24 hours, and there is no application process that lifts it. The escalation path that does exist runs only for federal system accounts: an incident filed at FSD.gov with the subject "API Rate Increase", carrying the system account username, the current and projected call volume, the affected endpoints and a business justification, which the agency's Change Control Board representative escalates for GSA review, case by case.

Two consequences worth planning around:

1,000/day is not a starting point you grow out of. For a non-federal integration it is the end of the road, so size the architecture for it up front rather than treating it as a temporary constraint.
Rate increases are described as rare exceptions even for those eligible. The guidance asks federal requesters to first optimise their calls, narrow their queries, or move to bulk extracts before requesting one.

Source: Federal Service Desk article KB0017604, "APIs: What are the API rate limits and how can I request a higher rate to pull more data?", last updated 17 March 2026. Checked 19 July 2026.

If You Are Hitting the Limit, Use Extracts Instead

The answer GSA points to first is not a bigger quota, it is a different distribution channel. A data extract is a flat file containing a complete data set, and no login is required to access public data extracts on SAM.gov. No account, no API key, and therefore no daily quota. The API exists to run a search against a data set and return matching records; the extract hands you the whole set.

That trade is the right one more often than people expect. If you are polling the API to rebuild a local copy of a data set, you are spending your entire daily quota reproducing a file that is already published. Pull the extract, then use the API only for the narrow, current-state queries that extracts cannot answer.

Where extracts stop. An extract is one domain's flat file, published on a cycle. That means three things it will not do for you:

No joins. Entities, exclusions, opportunities and award history are separate files. A question like "which open opportunities match this NAICS, where the likely awardee is not excluded" is a join across several extracts, which means you are running a database, not reading a file.
No current state between publications. The file is accurate as of the moment it was cut. If your workflow depends on what changed today, the extract is behind by design.
You own the pipeline. Download, decompress, parse, load, dedupe, detect schema drift and re-run it forever. That is a real ongoing cost, and it is the cost people underestimate when they compare a free file against a paid endpoint.

So the honest split: use extracts when you want a whole data set and are willing to run infrastructure for it. Use an API when you want a specific answer without maintaining a pipeline, or when the question spans data sets. Both of those are legitimate engineering positions, and which one is cheaper depends entirely on how much of your time the pipeline consumes.

Where the quota still binds, GSA's own efficiency guidance is the usual engineering discipline: handle HTTP 429 with exponential backoff and retry rather than hammering, request only the fields you need where the endpoint supports it, and page with the limit and offset parameters instead of pulling oversized responses.

Sources: Federal Service Desk articles KB0017664 (API versus data extract, and the no-login rule for public extracts), KB0029694 ("Contract Data: How do I use data services?"), and KB0099391 (recommendations for efficient use of API key rate limits). Checked 19 July 2026.

If the join is the reason you would build that pipeline, it is the part we already run: GovCon API serves opportunities, entities, exclusions and award history from one API and one key, at 1,000 / hour on paid plans, from $19/mo.

How the Limit Behaves in Practice

Four details the tier table leaves out.

The quota is per key, not per IP

SAM.gov tracks usage by API key. If you use the same key from different servers or locations, the requests count against the same daily quota. There is no IP-based blocking or geo-restriction. The API is accessible globally.

The daily limit resets at midnight UTC

When you hit the limit, SAM.gov returns a 429 response with a Retry-After header pointing to midnight UTC. Example response:

{"code":"900804","message":"Message throttled out","description":"You have exceeded your quota. You can access API after [tomorrow] 00:00:00+0000 UTC"}

There's no partial reset or sliding window during the day. Once you're out, you wait until midnight.

The budget is questions, not records

On the basic tier, 10 requests per day means 10 API calls total. Each call returns up to 1,000 records per page, so ten well-chosen calls can pull 10,000 records. The constraint is not volume, it is the number of distinct questions: every extra NAICS code, agency or state you want to watch separately is another call against the same 10.

The 1,000/day tier is gated on entity registration

Three steps stand between a basic key and a system account key:

Get a UEI, requested through SAM.gov as part of registration.
Complete SAM.gov entity registration. SAM.gov states this takes up to 10 business days.
Get the API role approved on the active entity. Your own Entity Administrator approves this, not the government: the Federal Service Desk states it "cannot release administrator names, nor approve or reject role requests." If there is no response after 5 business days, the escalation is an Entity Administrator Appointment Letter.

Sources: SAM.gov entity registration for the 10-business-day activation window, and FSD article KB0035972 for role-request approval. Checked 3 October 2026.

Registration is free, and it expires after a year. Renewal is part of running the integration, not a one-time setup task.

What 10 Requests/Day Actually Looks Like

Every distinct search is one request, which makes the budget easy to plan.

You can do this

Search IT contracts (NAICS 541512) in California: 1 request, up to 1,000 results
Pull all awards from the last 2 days: 1 request
Check a specific solicitation number: 1 request
Get all presolicitations in Virginia: 1 request

That's 4 requests. You have 6 left for the day.

You can't do this

Search 15 different NAICS codes daily (15 requests needed)
Monitor multiple agencies with different filters
Run a search and then paginate through all results (pagination burns requests)
Build an alert system that checks for new opportunities multiple times per day

What the API Doesn't Return

Rate limits aside, there are things the SAM.gov API simply doesn't include in its responses:

Full descriptions: The API returns a URL to the description, not the description text itself. Getting the actual requirements means a separate step for each opportunity.
Historical completeness: The API surfaces recently posted or modified opportunities. Long-running vehicles (IDIQs, BOAs) posted years ago don't appear in results even if they're still accepting proposals.
Exclusions in the same call: Exclusions (debarred entities) are on a completely different API endpoint with a different schema.

These aren't rate limit issues, but they affect how many requests you actually need to get the data you want.

When SAM.gov Direct Access Makes Sense

Government agencies with .gov/.mil emails get 10,000/day. That's plenty for most internal tools.
Occasional lookups where you search for a specific solicitation or check a few opportunities per day.
Prototyping where you need to validate an idea before investing in infrastructure.
Academic research with a narrow, well-defined query scope.

When it doesn't work

Daily monitoring: If you need to check multiple NAICS codes, agencies, or states every day, 10 requests won't cover it.
Production applications: Any product that depends on fresh contract data needs more reliable throughput than 10/day.
Full descriptions: If your use case requires the actual solicitation text, you need additional infrastructure beyond the API.
Compliance screening: The exclusions API is separate, so checking debarment status requires its own request budget.

Alternatives

If SAM.gov's rate limits don't work for your use case, you have a few options:

Register your entity in SAM.gov (free). Gets you 1,000/day. Good if your volume stays under that and you can wait out the registration.
Use a third-party API. GovCon API serves 1,000 / hour on paid plans, with a key issued at signup, and carries what SAM.gov leaves out of the notice response: every full notice description since October 2024 and the current exclusions list in the same API. From $19/mo.
Enterprise platforms. Web dashboards and analyst services built on the same public data. A different purchase from an API key: you are buying screens rather than a query surface, so the comparison is which of the two your workflow needs.

SAM.gov API Guide - Overview and getting started
Response Structure Reference - JSON parsing patterns
Capabilities vs Requirements - Choosing the right approach
SAM.gov Exclusions Guide - Bulk sync, deduplication, compliance
Federal Contracts API - Search FPDS prime contract transactions