DaData
DATA · DATA & ANALYTICS
Address, company, and bank lookups with suggestions and standardization.
Connecting DaData in practice
DaData counts 10,000 free suggestion requests a day across every suggestion type together, and answers an exhausted daily quota with 403 — the same status it uses for an unknown API key and for an unconfirmed email address. An agent cannot tell "out of quota" from "bad credentials" without opening the dashboard.
Rate limits
- Maximum request frequency: 30 requests per second from a single IP address.
- Free usage: 10,000 requests per day, counted across address, company, bank, name and email suggestions together. Suggestions stop answering until the next day.
- Beyond the free tier the daily request count follows the tariff plan.
- 429 is returned for too many requests per second, or too many new connections per minute.
- Per request: query at most 300 characters, count defaults to 10 and maxes at 20, and locations and locations_boost take at most 10 conditions each.
Worth knowing
- 403 covers three unrelated conditions — a non-existent API key, an unconfirmed email address, and an exhausted daily request limit — so it cannot be treated as a permanent authorization failure.
- 405 is returned for any HTTP method other than POST, and 413 for an over-long query or too many conditions, so malformed calls fail on the method before they fail on the data.
- Foreign addresses come back with a restricted field set regardless of tariff: postcode, country, region, settlement, timezone and coordinates only, everything else empty. Russia resolves to the flat, Belarus, Kazakhstan and Uzbekistan to the building, everywhere else to the city.
- "The user picked a specific address" is a specific API shape — count=1 with the query text taken from a previous response’s unrestricted_value — and a free-text query with count=1 is not the same thing.
Checked against DaData address suggestions API (2026-09-29), DaData API index (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put DaData behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.