429 error, with max API calls at 1/40 and no retry-after header

[HymnZ]

[Oops. I think I posted in the wrong discussion board. Can someone move it to the right one?]

Hi .. I'm facing an issue with my nodejs app .. I do all my process sequentially , i.e. one API call after another and nothing in parallel .. my app only deals with orders, fulfillments and metafields .. Below is the header I get after 10-15 calls in sequence .. As you can see, there is no retry-after header here

{
	HTTPError: Response code 429 (Too Many Requests) at stream.catch.then.data (/app/node_modules/got/index.js:386:13) at processTicksAndRejections (internal/process/task_queues.js:86:5)
	name: 'HTTPError',
	host: undefined,
	hostname: '-masked-',
	method: 'POST',
	path: '/admin/orders/-masked-/fulfillments.json',
	protocol: 'https:',
	url: undefined,
	statusCode: 429,
	statusMessage: 'Too Many Requests',
	headers: {
		date: 'Tue, 06 Aug 2019 11:39:22 GMT',
		'content-type': 'application/json; charset=utf-8',
		'transfer-encoding': 'chunked',
		connection: 'close',
		'set-cookie': ['__cfduid=d08bb0a259b5b5528b2ba62ee0574e9011565091562; expires=Wed, 05-Aug-20 11:39:22 GMT; path=/; domain=.myshopify.com; HttpOnly'],
		'x-sorting-hat-podid': '80',
		'x-sorting-hat-shopid': '11145904209',
		'referrer-policy': 'origin-when-cross-origin',
		'x-frame-options': 'DENY',
		'x-shopid': '11145904209',
		'x-shardid': '80',
		'x-stats-userid': '',
		'x-stats-apiclientid': '1803891',
		'x-stats-apipermissionid': '120584470609',
		http_x_shopify_shop_api_call_limit: '1/40',
		'x-shopify-shop-api-call-limit': '1/40',
		'strict-transport-security': 'max-age=7889238',
		'x-shopify-stage': 'production',
		'content-security-policy': "default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://*; block-all-mixed-content; child-src 'self' https://* shopify-pos://*; connect-src 'self' wss://* https://*; frame-ancestors 'none'; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://checkout.shopifycs.com https://js-agent.newrelic.com https://bam.nr-data.net https://dme0ih8comzn4.cloudfront.net https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com https://widget.intercom.io https://js.intercomcdn.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=create&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Forders%2Ffulfillments&source%5Bsection%5D=admin_api&source%5Buuid%5D=cedcbb6e-06a6-4113-9fde-d31cf0d2f1a7",
		'x-content-type-options': 'nosniff',
		'x-download-options': 'noopen',
		'x-permitted-cross-domain-policies': 'none',
		'x-xss-protection': '1; mode=block; report=/xss-report?source%5Baction%5D=create&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Forders%2Ffulfillments&source%5Bsection%5D=admin_api&source%5Buuid%5D=cedcbb6e-06a6-4113-9fde-d31cf0d2f1a7',
		'x-dc': 'gcp-us-east1,gcp-us-central1,gcp-us-central1',
		'x-request-id': 'cedcbb6e-06a6-4113-9fde-d31cf0d2f1a7',
		'expect-ct': 'max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"',
		server: 'cloudflare',
		'cf-ray': '5020bad9e829e0ea-IAD'
	}
}

Can someone explain what is happening here?

[Jason · Accepted solution]

What's the contents of the response vs just the headers? That might give you some more clues.

Take a look at the docs for fulfilment:
https://help.shopify.com/en/api/reference/shipping-and-fulfillment/fulfillment#create-2019-04

There's a note there:

If you are using this endpoint with a Partner development store or a trial store, then you can create no more than 5 new fulfillments per minute.

Is this a dev/trial shop? Is so, the note is relevant.