100 requests per minute per key, with X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on every response; beyond that, 429 with Retry-After.
The limit
Each key can make 100 requests per minute on the external API, counted per one-minute window. Every response carries the headers X-RateLimit-Limit (the ceiling), X-RateLimit-Remaining (how many still fit in the window) and X-RateLimit-Reset (when the window turns, in Unix seconds).
Past the ceiling, the response is 429 with the Retry-After header saying in how many seconds to try again, and the same information goes in the body for clients that do not read headers.
Staying under the limit
Read X-RateLimit-Remaining and slow down when it gets low. For large initial loads (onboarding hundreds of employees), space out the calls or split them into batches per minute. Paginated queries count one request per page.
Scopes
Scopes follow the resource:action format and apply per endpoint: employees:read to list and read employees, employees:write to create and update, payroll:read for periods and payrolls, payroll:write to open a period, calculate, approve and mark as paid, departments and positions in read and write, timeclock:read and timeclock:write for time entries and reports:read for reports. A key without the scope gets 403, and no scope allows deleting data through the API.