Rate limits

The platform enforces per-IP limits: 300 requests/minute on reads, 60/minute on writes, and 10/minute on auth endpoints. Each API key additionally records a per-minute and per-day quota (defaults 60/min and 10,000/day). Set them when creating the key or adjust them later via PATCH /api/v1/api-keys/:id; there is no Settings UI for per-key overrides yet.

Every rate-limited response reports its per-IP quota through the draft-RFC headers RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset (seconds until the current minute window rolls over). Exceeding a limit returns 429 with a Retry-After header:

HTTP/2 429
Retry-After: 42
RateLimit-Limit: 300
RateLimit-Remaining: 0
RateLimit-Reset: 42

{
  "error": "Too Many Requests",
  "message": "Rate limit exceeded. Max 300 requests per minute for read operations.",
  "retry_after_seconds": 42
}

If the limiter is temporarily degraded, requests pass through without quota headers. A missing RateLimit-* set means no quota was checked on that response, not that none applies.

Return to the REST API reference for authentication and endpoint examples.