Yes, to prevent abusive usage, requests to the API might be limited to 200 per hour and per IP address. If this limit is reached, the API will return an HTTP status code 429, indicating "Too Many Requests."
Quotas: 200 requests allowed per hour per IP address. HTTP status code 429 (Too Many Requests) will be returned if the limit is reached. Payload Size: The maximum payload size for the PATCH request body is 5 MB
Please note that since last 30th June we don't give support to the XML API so we encourage you to migrate to the REST API as soon as possible if you still haven't done it. You can contact us for any question you may have for this process.
The "WAITING_PAYMENT" status is related to the order processing cycle. However, as of now, the "WAITING_PAYMENT" status is not available in the Orders API (REST).