#11734 [VIES Integration] Per-environment daily request rate-limit
A per-tenant daily rate-limit of 2000 VIES lookups prevents a single tenant from flooding the shared outbound IP used by Business Central online, which could deny-list the IP for all co-located tenants.
- 4files
- 3AL files
- 3objects
Pull request · merged into main (BC30) on 2026-09-24 by dcenic · 4 files (+306 -0), 3 AL · feature · tier official · reviewed (checked by Opus)
What changed
- New table 243 ‘VAT Reg. No. Lookup Quota’ and codeunit 247 ‘VAT Lookup Quota Mgt.’ enforce a daily limit in codeunit 248 before the SOAP call to VIES
- The counter resets when the UTC day changes and is shared by all callers, including extensions, job queue and API callers
- The 2000 lookups per day cap is about 10x the 99th-percentile legitimate usage and about 10x below the volume that triggers VIES deny-listing
- Applies only to Business Central online; on-premises behavior is unchanged
- Once the cap is reached lookups fail with an error for the rest of the UTC day; the call hitting the limit logs a security-audit entry and telemetry
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 248 “VAT Lookup Ext. Data Hndl”, Base Application: modified
- Codeunit 247 “VAT Lookup Quota Mgt.”, Base Application: added
- Table 243 “VAT Reg. No. Lookup Quota”, Base Application: added
Context
- Work items: AB#651007
- Labels: Team: Finance
- Systems: finance
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).