HERE
DATA · DATA & ANALYTICS
Routes, isolines, transit departures, and forward and reverse geocoding.
Connecting HERE in practice
HERE does not publish its per-endpoint rate limits: its own documentation states that all API endpoints are subject to rate limits, that those limits are adjusted and not disclosed in detail, and that a 429 with Retry-After is the only signal you get. HERE also returns 429 or 503 for up to about ten minutes during traffic surges even when no quota has been reached, so a 429 is not evidence of being over budget.
Scopes that draw scrutiny
HERE API keyThe credential HERE recommends for client apps, and the simplest to leak, because it authenticates by itself with no paired secret.OAuth 2.0 access tokenValid for up to 24 hours, and an app can use a maximum of two tokens at a time, so rotation has to be deliberate rather than per worker.RESTRICTED-tagged featuresHERE tags some request parameters and response fields RESTRICTED: they are available only under a specific contract, and an unauthorized use returns 403 rather than a quieter omission.
Rate limits
- HERE Account APIs: 25,000 requests per 15 minutes per appId, enforced at 1,666 requests per minute across all calls.
- Service endpoints: "All API endpoints are subject to rate limits. These limits are subject to adjustments and are not disclosed in detail."
- Batch API v7: 1 million records per job and 500 MB of uncompressed input, both returning 413 Payload Too Large.
- Batch API v7: 512 characters per recId, 4,096 characters per record line, and 500 jobs in a startable state before a 429.
- During traffic surges HERE services may return 429 or 503 for up to about 10 minutes even when quotas have not been reached.
Worth knowing
- HERE offers no throughput guarantee for a batch job and no guarantee of how long one may sit queued, so a batch geocode has no documented figure to set a timeout against.
- Features tagged ALPHA can change or be removed with no backward compatibility and no bug SLA, while BETA features are backward compatible but unfinished in coverage and quality — and the tags live on individual fields, not whole endpoints.
- Two tokens per app is the ceiling, so a fleet of workers sharing one appId cannot each hold their own OAuth token.
- Quota exhaustion and transient overload are both 429 or 503, so retry logic cannot tell "you are over your plan" from "try again in a minute".
Checked against Batch API limits and performance (2026-09-29), Limits and quotas (2026-09-29), Authorize with OAuth 2.0 (2026-09-29), Introduction to Geocoding and Search API v7 (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put HERE behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.