Rate limits

The public API enforces multiple limits. When you exceed any of them the server returns 429 Too Many Requests with error.code = "rate_limited".

Design clients to read remaining quota before bursts, and to back off cleanly when a window is exhausted. Shared tenants should coordinate automation so one noisy key does not starve siblings under the tenant cap.

Prerequisites

Authenticated requests (Authentication).
An HTTP client that can read response headers and Retry-After.
Error parsing for the standard envelope (Errors).

Limits

Scope	Default limit	Window
Per API key	600 requests	60 seconds
Per tenant (sum across keys)	6000 requests	60 seconds
Per IP on `/api/v1/*`	1200 requests	60 seconds
Per IP on auth endpoints (`POST /auth/login`, `POST /auth/register`, etc.)	5 requests	900 seconds

Some endpoints have additional safety limits (for example, bulk import). Where applicable, the operation page calls them out.

Headers on every response

Every successful or rate-limited response includes:

Header	Meaning
`X-RateLimit-Limit`	Total allowed requests in the current window
`X-RateLimit-Remaining`	Requests remaining in the window
`X-RateLimit-Reset`	Epoch seconds when the window resets

Handling 429 responses

A 429 response includes a Retry-After header (seconds) and the standard error envelope:

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded for this API key.",
    "correlation_id": "5b1cba7c-f2c2-4a55-9d3a-1e22b7e04e33"
  }
}

Recommended client behaviour

Read X-RateLimit-Remaining and slow down before you hit zero.
On 429, wait at least Retry-After seconds before retrying. Do not retry sooner.
Use exponential backoff with full jitter for repeated 429s: delay = random(0, base * 2^attempt) capped at 60 seconds.
If you regularly run into limits, batch operations instead of issuing one request per item, or contact us about a higher-tier limit.

Troubleshooting

Hitting limits during pagination — increase limit (up to 200) and reduce parallel workers; see Pagination.
Auth endpoints locked — the per-IP auth window is stricter. Wait for Retry-After and avoid login loops in tests.
One integration starves others — split API keys and throttle the noisy worker; tenant limits sum across keys.
Need the error fields — use Errors and always log correlation_id when opening a ticket.