Requests are limited per access token, and each account has one token. The default limit is 60 requests per minute. It is counted in fixed one-minute windows, not as an average: once a token reaches the limit, further requests in that minute are refused until the next window starts. The limit can be raised for an account; talk to us if your integration needs more.
A rate-limited request returns HTTP 429 (Too Many Requests) with a Retry-After header, an integer number of seconds. Wait at least that long before sending the next request.
Integrations should handle HTTP 429 and respect Retry-After. Alternatively, slow down the pace of requests: a common approach is one or more queues of pending requests, consumed as long as Certify does not respond with HTTP 429.