SAM.gov API Rate Limits Explained

What each SAM.gov API access tier allows per day, who is eligible to ask for more, and what GSA points you to when the quota binds.

Rate Limits by Access Tier

Can You Get the Limit Raised? Only If You Are Federal

This is the part that is rarely written down, and it decides whether the API can carry a commercial workload at all. GSA's guidance is explicit: only federal system account users can request a rate increase. If you are a non-federal user, or you are using an individual account API key, your account is not eligible to be considered for the exception.

So the practical ceiling for a non-federal system account is 1,000 requests per 24 hours, and there is no application process that lifts it. The escalation path that does exist runs only for federal system accounts: an incident filed at FSD.gov with the subject "API Rate Increase", carrying the system account username, the current and projected call volume, the affected endpoints and a business justification, which the agency's Change Control Board representative escalates for GSA review, case by case.

Two consequences worth planning around:

1,000/day is not a starting point you grow out of. For a non-federal integration it is the end of the road, so size the architecture for it up front rather than treating it as a temporary constraint.
Rate increases are described as rare exceptions even for those eligible. The guidance asks federal requesters to first optimise their calls, narrow their queries, or move to bulk extracts before requesting one.

Source: Federal Service Desk article KB0017604, "APIs: What are the API rate limits and how can I request a higher rate to pull more data?", last updated 17 March 2026. Checked 19 July 2026.

If You Are Hitting the Limit, Use Extracts Instead

The answer GSA points to first is not a bigger quota, it is a different distribution channel. A data extract is a flat file containing a complete data set, and no login is required to access public data extracts on SAM.gov. No account, no API key, and therefore no daily quota. The API exists to run a search against a data set and return matching records; the extract hands you the whole set.

That trade is the right one more often than people expect. If you are polling the API to rebuild a local copy of a data set, you are spending your entire daily quota reproducing a file that is already published. Pull the extract, then use the API only for the narrow, current-state queries that extracts cannot answer.

Where extracts stop. An extract is one domain's flat file, published on a cycle. That means three things it will not do for you:

No joins. Entities, exclusions, opportunities and award history are separate files. A question like "which open opportunities match this NAICS, where the likely awardee is not excluded" is a join across several extracts, which means you are running a database, not reading a file.
No current state between publications. The file is accurate as of the moment it was cut. If your workflow depends on what changed today, the extract is behind by design.
You own the pipeline. Download, decompress, parse, load, dedupe, detect schema drift and re-run it forever. That is a real ongoing cost, and it is the cost people underestimate when they compare a free file against a paid endpoint.

So the honest split: use extracts when you want a whole data set and are willing to run infrastructure for it. Use an API when you want a specific answer without maintaining a pipeline, or when the question spans data sets. Both of those are legitimate engineering positions, and which one is cheaper depends entirely on how much of your time the pipeline consumes.

Where the quota still binds, GSA's own efficiency guidance is the usual engineering discipline: handle HTTP 429 with exponential backoff and retry rather than hammering, request only the fields you need where the endpoint supports it, and page with the limit and offset parameters instead of pulling oversized responses.

Sources: Federal Service Desk articles KB0017664 (API versus data extract, and the no-login rule for public extracts), KB0029694 ("Contract Data: How do I use data services?"), and KB0099391 (recommendations for efficient use of API key rate limits). Checked 19 July 2026.

If the join is the reason you would build that pipeline, it is the part we already run: GovCon API serves opportunities, entities, exclusions and award history from one API and one key, at 1,000 / hour on paid plans, from $19/mo.

How the Limit Behaves in Practice

Four details the tier table leaves out.

The quota is per key, not per IP

SAM.gov tracks usage by API key. If you use the same key from different servers or locations, the requests count against the same daily quota. There is no IP-based blocking or geo-restriction. The API is accessible globally.

The daily limit resets at midnight UTC

When you hit the limit, SAM.gov returns a 429 response with a Retry-After header pointing to midnight UTC. Example response:

{"code":"900804","message":"Message throttled out","description":"You have exceeded your quota. You can access API after [tomorrow] 00:00:00+0000 UTC"}

There's no partial reset or sliding window during the day. Once you're out, you wait until midnight.

The budget is questions, not records

On the basic tier, 10 requests per day means 10 API calls total. Each call returns up to 1,000 records per page, so ten well-chosen calls can pull 10,000 records. The constraint is not volume, it is the number of distinct questions: every extra NAICS code, agency or state you want to watch separately is another call against the same 10.

The 1,000/day tier is gated on entity registration

Three steps stand between a basic key and a system account key:

Get a UEI, requested through SAM.gov as part of registration.
Complete SAM.gov entity registration. SAM.gov states this takes up to 10 business days.
Get the API role approved on the active entity. SAM.gov publishes no turnaround for this step.

Registration is free, and it expires after a year. Renewal is part of running the integration, not a one-time setup task.

What 10 Requests/Day Actually Looks Like

Every distinct search is one request, which makes the budget easy to plan.

You can do this

Search IT contracts (NAICS 541512) in California: 1 request, up to 1,000 results
Pull all awards from the last 2 days: 1 request
Check a specific solicitation number: 1 request
Get all presolicitations in Virginia: 1 request

That's 4 requests. You have 6 left for the day.

You can't do this

Search 15 different NAICS codes daily (15 requests needed)
Monitor multiple agencies with different filters
Run a search and then paginate through all results (pagination burns requests)
Build an alert system that checks for new opportunities multiple times per day

What the API Doesn't Return

Rate limits aside, there are things the SAM.gov API simply doesn't include in its responses:

Full descriptions: The API returns a URL to the description, not the description text itself. Getting the actual requirements means a separate step for each opportunity.
Historical completeness: The API surfaces recently posted or modified opportunities. Long-running vehicles (IDIQs, BOAs) posted years ago don't appear in results even if they're still accepting proposals.
Exclusions in the same call: Exclusions (debarred entities) are on a completely different API endpoint with a different schema.

These aren't rate limit issues, but they affect how many requests you actually need to get the data you want.

When SAM.gov Direct Access Makes Sense

Alternatives

If SAM.gov's rate limits don't work for your use case, you have a few options:

Register your entity in SAM.gov (free). Gets you 1,000/day. Good if your volume stays under that and you can wait out the registration.
Use a third-party API. GovCon API serves 1,000 / hour on paid plans, with a key issued at signup, and carries what SAM.gov leaves out of the notice response: every full notice description since October 2024 and the current exclusions list in the same API. From $19/mo.
Enterprise platforms. Web dashboards and analyst services built on the same public data. A different purchase from an API key: you are buying screens rather than a query surface, so the comparison is which of the two your workflow needs.