# Third-party rate limit hit: pre-release checklist

Source: https://releasefailures.com/incidents/third-party-rate-limit-hit/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A new call pattern exceeds a provider's quota and requests are rejected.
- [ ] PR-01 Send one webhook event for a single entity and confirm the sync cache keeps its entries for every other entity. (test class: Integration tests)
- [ ] PR-02 Count outbound code host API calls during a test run of 100 webhook events and fail the build when the count exceeds the previous release's count. (test class: Integration tests)
- [ ] PR-03 Replay production webhook volume against a staging copy with the production number of remote entities and confirm outbound provider calls stay below the provider's rate limit. (test class: Load and performance tests)
- [ ] PR-04 Record the cache hit rate during the load run and fail it when the rate drops below the previous release's rate. (test class: Load and performance tests)
- [ ] PR-05 Before onboarding a new region, load the regional authentication layer at the region's expected traffic and confirm its calls to the global dependency stay under the dependency's throttle limit. (test class: Load and performance tests)
- [ ] PR-06 Compare outbound provider calls per request between canary and baseline and halt the rollout when the canary's rate is higher. (test class: Canary and progressive delivery checks)
- [ ] PR-07 Halt the rollout when the canary receives any HTTP 429 response from a provider. (test class: Canary and progressive delivery checks)