Skip to main content
KSeF 2.0 · API

KSeF HTTP 429, 403 and 401: request limits and access denied

These three answers have no five-digit KSeF code, because they are plain HTTP codes. They still follow rules: 429 comes with a Retry-After header, 403 with a reasonCode field that says what is missing, and 401 means the access token expired.

FlexigoTech · Editor in charge: Víctor Gómez · Updated 5 November 2026

Key facts

Module
KSeF 2.0
Versions
Odoo 17, 18, 19 and 20
Checked
against the sources linked at the end
Reading time
3 min

Request limit: 429

Over the limit, KSeF answers HTTP 429 “Too Many Requests” with a Retry-After header and blocks access to the API for the time given. The documentation's example: “Przekroczono limit 20 żądań na minutę. Spróbuj ponownie po 30 sekundach.” (limit of 20 requests per minute exceeded; try again after 30 seconds). Limits count per second, minute and hour. The higher limits between 20:00 and 06:00 apply only to downloading, and their values have not been published yet; sending invoices gets no higher limits at night.

What matters most when sending from Odoo:

  • sending an invoice: 10 per second, 30 per minute, 180 per hour;
  • opening an interactive session: 10, 30 and 120;
  • invoice status in a session: 30, 120 and 1200;
  • other requests: 10, 30 and 120.
KSeF HTTP 429, 403 and 401 card
429 with the API text, plus 401 and 403, which come without a KSeF code.

Access denied: 403 and its reasonCode

reasonCodeKSeF text
missing-permissions“Brak wymaganych uprawnień do wykonania operacji w bieżącym kontekście.” (missing permissions in the current context)
ip-not-allowed“Żądanie pochodzi z adresu IP innego niż wskazany podczas uwierzytelnienia.” (request from an IP other than the one given at sign-in)
insufficient-resource-access“Brak dostępu do wskazanego zasobu.” (no access to that resource)
auth-method-not-allowed“Ta operacja nie jest dostępna dla użytej metody uwierzytelnienia.” (not available for that sign-in method)
security-service-blocked“Żądanie zostało zablokowane przez mechanizmy bezpieczeństwa.” (blocked by security mechanisms)
context-type-not-allowed“Operacja nie jest dostępna dla uwierzytelnionego typu kontekstu.” (not available for that context type)

401 and 403 answers come in the Problem Details format, and 400 and 429 can too if the program sends the header X-Error-Format: problem-details. Odoo does not send it.

What Odoo 18, 19 and 20 do

On a 401 Odoo refreshes the access token and repeats the request once. On a 403 it shows “KSeF API Error: ” with the response body, so you will see the reasonCode in the message. On a 429 it raises the error “Too Many Requests”:

  • when sending, the invoice gets that error and stays without a KSeF status, and Retry-After is ignored: send it again a little later;
  • downloading vendor bills, which Odoo does every 3 hours, reads Retry-After and reschedules itself.

After sending, Odoo asks for the status up to 5 times, 2 seconds apart. With many invoices sent at once, those requests count towards the status limit too.

Diagram: what KSeF returns for HTTP answers 429, 403 and 401 and what Odoo 20 shows
Diagram based on the l10n_pl_edi code of Odoo 20 and the KSeF API 2.9.0 specification; struck-through items are what Odoo does not keep or do.

How to avoid 429

An invoice that got “Too Many Requests” has no KSeF status, because KSeF did not take the request, so it goes back to the invoices you can send and there is no risk of it reaching KSeF twice. Send invoices in smaller groups and do not click resend repeatedly. If you regularly hit the sending limits of the interactive session, the Ministry of Finance advises considering batch mode first and, where the interactive session is a must, contacting KSeF support. Odoo only sends invoices in an interactive session. Our module, Poland KSeF 2.0 Validator, sends no requests to KSeF, so it does not use up these limits; with the subscription, its FA(3) validation goes to FlexigoTech Cloud.

Will a 403 security-service-blocked clear by itself?

The documentation only says the request was blocked by security mechanisms. If it keeps happening with correct data, report it to KSeF support.

Keep reading

KSeF exceptions when sending an invoice: 21405, 21180, 21184 and the restKSeF exceptions when sending an invoice: 21405, 21001, 21155, 21166, 21167, 21173, 21180, 21184, 21402 and 21403. What they mean and how Odoo 18-20 show them.KSeF authentication statuses: 415, 425, 450, 470 and 480KSeF 2.0 sign-in statuses besides certificates: no permissions, revoked, bad token, blocked. Codes 21301 and 21304 and how they look in Odoo 18-20.KSeF codes 410 and 415: seller permissions and attachmentsKSeF 410 “Nieprawidłowy zakres uprawnień” and 415 for invoices with attachments: what triggers them in the Ministry's tests and what to check in Odoo 18-20.
Checked against the linked sources

Sources