The Companies House public data API is free, well documented and fast. It is also rate limited, and the limit tends to surface at the worst moment: a bulk import, a busy onboarding morning, or a background job that quietly shares a key with production. This guide explains the limit and the patterns that keep an integration comfortably inside it.

The limit in one sentence

Companies House allows each application up to 600 requests in a five-minute window. Once you exceed it, further requests in that window receive HTTP 429 (Too Many Requests) until the window resets. The developer guidelines also say that applications which regularly exceed the limit, or try to get around it, can be blocked. Treat it as a budget to manage, not a ceiling to bounce off.

Six hundred requests in five minutes averages out at two per second. That is plenty for interactive lookups, but a loop over a few thousand company numbers will reach it within minutes.

Read the rate-limit headers

Responses include headers that describe where you are in the current window: X-Ratelimit-Limit (the allowance), X-Ratelimit-Remain (requests left), X-Ratelimit-Reset (when the window resets) and X-Ratelimit-Window (its length, for example 5m). They are not listed prominently in the main documentation, but Companies House staff have confirmed them on the developer forum. Record them with your request metrics: they turn a mysterious 429 into a visible trend.

Pace requests; do not burst

The simplest approach is a fixed delay of about half a second between requests. It works, but it wastes capacity when traffic is light. A better approach is a shared limiter, such as a token bucket or sliding window, that every part of your system draws from. The limit applies to the application, not to a single process, so three workers each pacing themselves at two requests a second will still exceed it together.

Give each environment its own Companies House application and key. Otherwise a test run or a developer’s script can spend the budget your production system needs.

Handle 429 deliberately

When a 429 arrives, stop sending requests on that key until the window resets, then resume gradually. Immediate retries in a tight loop only extend the problem and look like an attempt to get around the limit. Reads are safe to retry, so queue the work rather than failing it, and tell the person waiting that the data will follow shortly instead of showing a generic error.

Do not mistake other errors for rate limiting

A 403 is not a rate-limit signal. It can mean a key restricted to other IP addresses, an invalid key, or a block on the application, and retrying will not fix it. Occasional 5xx responses can occur even with plenty of allowance remaining; retry those a small, capped number of times with increasing delays, then report the failure. Keeping these cases separate makes incidents much quicker to diagnose.

Cache what changes slowly

Most company data does not change minute to minute. A company profile, its officers and persons with significant control can usually be cached for hours, while search results and filing history deserve shorter lifetimes. As a reference point, GovBridge currently caches Companies House search results for five minutes, filing history for one hour, and profiles, officers, persons with significant control and charges for six hours. Decide each lifetime from the workflow: a compliance check performed at a specific moment may need fresh data, while a CRM enrichment job rarely does.

When you genuinely need more

If your workload is large by nature, the API may be the wrong tool. Companies House publishes a free monthly bulk snapshot of basic company data and a streaming API that pushes changes as they happen. Combining a bulk baseline with streamed updates often removes most per-company lookups. Companies House may consider a modest limit increase for a well-explained use case, but expect to be asked why bulk data or streaming would not work first.

How GovBridge fits

GovBridge, our gateway for UK government APIs, puts Companies House behind one API key with consistent JSON and error responses, and applies the caching described above so repeated lookups do not spend the upstream allowance. It is in developer preview: you can register at www.govbridge.co.uk for 500 free credits, and a company profile lookup costs one credit. If you would rather we built or reviewed your own integration, email hello@yugsolutions.co.uk.