SAM.gov API Rate Limits Explained

Complete breakdown of SAM.gov's API rate limits by access tier, including how to get higher limits and alternatives for high-volume use cases.

Rate Limits by Access Tier

Can You Get the Limit Raised? Only If You Are Federal

This is the part that is rarely written down, and it decides whether the API can carry a commercial workload at all. GSA's guidance is explicit: only federal system account users can request a rate increase. If you are a non-federal user, or you are using an individual account API key, your account is not eligible to be considered for the exception.

So the practical ceiling for a non-federal system account is 1,000 requests per 24 hours, and there is no application process that lifts it. The escalation path that does exist runs only for federal system accounts: an incident filed at FSD.gov with the subject "API Rate Increase", carrying the system account username, the current and projected call volume, the affected endpoints and a business justification, which the agency's Change Control Board representative escalates for GSA review, case by case.

Two consequences worth planning around:

1,000/day is not a starting point you grow out of. For a non-federal integration it is the end of the road, so size the architecture for it up front rather than treating it as a temporary constraint.
Rate increases are described as rare exceptions even for those eligible. The guidance asks federal requesters to first optimise their calls, narrow their queries, or move to bulk extracts before requesting one.

Source: Federal Service Desk article KB0017604, "APIs: What are the API rate limits and how can I request a higher rate to pull more data?", last updated 17 March 2026. Checked 19 July 2026.

If You Are Hitting the Limit, Use Extracts Instead

The answer GSA points to first is not a bigger quota, it is a different distribution channel. A data extract is a flat file containing a complete data set, and no login is required to access public data extracts on SAM.gov. No account, no API key, and therefore no daily quota. The API exists to run a search against a data set and return matching records; the extract hands you the whole set.

That trade is the right one more often than people expect. If you are polling the API to rebuild a local copy of a data set, you are spending your entire daily quota reproducing a file that is already published. Pull the extract, then use the API only for the narrow, current-state queries that extracts cannot answer.

Where extracts stop. An extract is one domain's flat file, published on a cycle. That means three things it will not do for you:

No joins. Entities, exclusions, opportunities and award history are separate files. A question like "which open opportunities match this NAICS, where the likely awardee is not excluded" is a join across several extracts, which means you are running a database, not reading a file.
No current state between publications. The file is accurate as of the moment it was cut. If your workflow depends on what changed today, the extract is behind by design.
You own the pipeline. Download, decompress, parse, load, dedupe, detect schema drift and re-run it forever. That is a real ongoing cost, and it is the cost people underestimate when they compare a free file against a paid endpoint.

So the honest split: use extracts when you want a whole data set and are willing to run infrastructure for it. Use an API when you want a specific answer without maintaining a pipeline, or when the question spans data sets. Both of those are legitimate engineering positions, and which one is cheaper depends entirely on how much of your time the pipeline consumes.

Where the quota still binds, GSA's own efficiency guidance is the usual engineering discipline: handle HTTP 429 with exponential backoff and retry rather than hammering, request only the fields you need where the endpoint supports it, and page with the limit and offset parameters instead of pulling oversized responses.

Sources: Federal Service Desk articles KB0017664 (API versus data extract, and the no-login rule for public extracts), KB0029694 ("Contract Data: How do I use data services?"), and KB0099391 (recommendations for efficient use of API key rate limits). Checked 19 July 2026.

What We've Observed

We work with the SAM.gov API daily. Here's what we've found about how the rate limits actually behave.

The quota is per key, not per IP

SAM.gov tracks usage by API key. If you use the same key from different servers or locations, the requests count against the same daily quota. There is no IP-based blocking or geo-restriction. The API is accessible globally.

The daily limit resets at midnight UTC

When you hit the limit, SAM.gov returns a 429 response with a Retry-After header pointing to midnight UTC. Example response:

{"code":"900804","message":"Message throttled out","description":"You have exceeded your quota. You can access API after [tomorrow] 00:00:00+0000 UTC"}

There's no partial reset or sliding window during the day. Once you're out, you wait until midnight.

10 requests goes fast

On the basic tier, 10 requests per day means 10 API calls total. Each call returns up to 1,000 records per page, so you can get a decent amount of data if you plan your queries. But if you need to run different searches (by NAICS, by agency, by state), you run out of requests quickly.

Entity registration takes 2-3 weeks

To get the 1,000/day tier, you need:

UEI Number - usually same day
SAM.gov Entity Registration - up to 10 business days
API Role Approval - a few more days after entity is active

Total: about 2-3 weeks. Free, but requires annual renewal.

What 10 Requests/Day Actually Looks Like

Here are some real scenarios:

You can do this

Search IT contracts (NAICS 541512) in California: 1 request, up to 1,000 results
Pull all awards from the last 2 days: 1 request
Check a specific solicitation number: 1 request
Get all presolicitations in Virginia: 1 request

That's 4 requests. You have 6 left for the day.

You can't do this

Search 15 different NAICS codes daily (15 requests needed)
Monitor multiple agencies with different filters
Run a search and then paginate through all results (pagination burns requests)
Build an alert system that checks for new opportunities multiple times per day

What the API Doesn't Return

Rate limits aside, there are things the SAM.gov API simply doesn't include in its responses:

Full descriptions: The API returns a URL to the description, not the description text itself. Getting the actual requirements means a separate step for each opportunity.
Historical completeness: The API surfaces recently posted or modified opportunities. Long-running vehicles (IDIQs, BOAs) posted years ago don't appear in results even if they're still accepting proposals.
Exclusions in the same call: Exclusions (debarred entities) are on a completely different API endpoint with a different schema.

These aren't rate limit issues, but they affect how many requests you actually need to get the data you want.

When SAM.gov Direct Access Makes Sense

Alternatives

If SAM.gov's rate limits don't work for your use case, you have a few options:

Register for entity access (free, 2-3 weeks): Gets you 1,000/day. Good if you can wait and your volume stays under that.
Use a third-party API: Services like GovCon API provide higher limits (1,000/hour), instant access, and additional data like full descriptions and exclusions. Typically $19/month.
Enterprise platforms: several commercial tools offer web-based dashboards with unlimited access but typically start at thousands per year and don't provide API access for custom integrations.