{
  "schema_version": "1.7.0",
  "id": "x_SHAPI-xero-invoices-email-daily-limit-429",
  "modified": "2027-01-14T00:00:00Z",
  "published": "2026-10-15T00:00:00Z",
  "summary": "Invoice email daily limit returns 429 instead of 500 from 2027-01-14",
  "details": "From 2027-01-14, POST Invoices/{InvoiceID}/Email returns 429 Too Many Requests instead of a generic 500 when the organisation reaches its daily invoice-email limit. The 429 has no Retry-After header. Code that treats 500 as a retryable server error, or retries a 429 at once with a short backoff, will mishandle the limit.\n\nHandle a 429 from the invoice Email endpoint separately from the per-minute rate limit. It is a daily limit with no Retry-After header, so don't retry immediately. Queue the send for after the daily reset, or tell the user sending was delayed. Stop relying on a 500 to detect this case.",
  "affected": [
    {
      "ecosystem_specific": {
        "provider": "xero",
        "endpoint": {
          "method": "POST",
          "path": "/api.xro/2.0/Invoices/{InvoiceID}/Email"
        },
        "change_class": "status-code",
        "trigger": {
          "statusCodes": [
            500
          ],
          "newStatusCodes": [
            429
          ]
        },
        "effective_date": "2027-01-14"
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://developer.xero.com/changelog"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
    }
  ],
  "database_specific": {
    "severity": "medium",
    "status": "verified",
    "url": "https://shapi.dev/osv/xero-invoices-email-daily-limit-429.json"
  }
}