monday.com
PROJECT MANAGEMENT · TASKS
Boards, groups, items, and docs in the workspaces that person can see.
Connecting monday.com in practice
monday.com bills GraphQL in complexity points rather than requests, and a single query is capped at 5,000,000 points against a 5M-per-minute read budget for an app token, so one over-nested board query can consume a whole minute in one call. Daily call limits are plan-based and low: 1,000 a day on Free, Standard and Basic, 10,000 on Pro and 25,000 on Enterprise.
Rate limits
- App tokens: 5M complexity points per minute each, with separate budgets for reads and writes.
- Personal API tokens: 10M points per minute combined, or 1M for trial, NGO and free accounts.
- A single query may not exceed 5,000,000 complexity points.
- Daily calls: 1,000 on Free, Standard and Basic; 10,000 on Pro; 25,000 on Enterprise.
- Queries per minute: 1,000 on other plans, 2,500 on Pro, 5,000 on Enterprise.
- Concurrent requests: 40 on other plans, 100 on Pro, 250 on Enterprise.
- 5,000 requests per 10 seconds per individual IP address.
- RateLimit-Policy declares the quota, window and units; RateLimit reports remaining quota and reset time.
Worth knowing
- Six different limits apply at once — complexity, daily calls, per-minute queries, concurrency, per-IP and the per-query cap — and the first one reached is what throttles you, so a single retry policy will not cover all of them.
- App tokens and personal tokens get different budgets, 5M each way against 10M combined, so a test with a personal token does not predict production behaviour.
- The per-IP limit of 5,000 requests per 10 seconds is shared by everything behind one egress address, which co-tenanted agents hit without exceeding their own quota.
- Adding a complexity field to any query returns before, query, after and reset_in_x_seconds, which is the only reliable way to price a query before shipping it.
Checked against monday.com rate limits (2026-09-29), monday.com complexity (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put monday.com behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.