Giving the APIs a breather

Every week, find the best take on stories at the intersection of tech, policy and business here

- Charles Assisi

At 3 am, when most of the country sleeps, UPI doesn't. Refunds are processed. Mandates get triggered. A balance request pings a bank server. Billions of such actions, all powered by silent code-Application Programming Interfaces, or APIs—that keep India’s digital economy humming. But now, that hum is getting a volume cap.

Starting August 1, the National Payments Corporation of India (NPCI) will enforce new restrictions on how frequently UPI apps can access critical backend services. A user will be allowed to check their bank balance no more than 50 times a day, per app. Viewing linked accounts will be capped at 25 times. Failed payment status checks can only be triggered three times in two hours, with mandatory pauses between each request. Autopay mandates will run during non-peak hours.

These aren't front-end changes. They affect what most people never see—the machinery that makes UPI feel seamless. But these changes are also a signal: the pipes are getting crowded.

If APIs are efficient, automated, and tireless, why limit them? Because the systems they talk to aren't tireless. Each API call, whether it’s fetching a balance or confirming a transaction, must reach deep into bank servers, account databases, authentication systems, and sometimes third-party verification layers. These underlying systems weren't designed to be poked and prodded thousands of times per second by apps running automated refresh loops.