Rate limits

Request rate

Limits apply to each API key; the workspace’s plan sets the numbers. A key has a per-second limit (a sliding one-second window) and a daily quota that resets at midnight UTC. Dashboard sessions are not rate limited.

Requests rejected for a missing scope or module (403) are not counted; any request that passes authentication is, whatever its result.

Headers

Every response that passed the limiter carries the remaining budget. X-RateLimit-Limit and X-RateLimit-Remaining describe the per-second window; the Daily pair appears when the key has a daily quota.

HTTP/2 200X-RateLimit-Limit: 20X-RateLimit-Remaining: 19X-RateLimit-Daily-Limit: 100000X-RateLimit-Daily-Remaining: 98431

What a 429 looks like

A throttled request returns 429 with code rate_limit_exceeded, the standard error envelope and a Retry-After header in whole seconds. Wait at least that long before retrying; back off exponentially if you are throttled again.

HTTP/2 429Content-Type: application/jsonRetry-After: 1 {"code":"rate_limit_exceeded","message":"API key rate limit exceeded.","requestId":"3f2b6c1e-…","retryable":true}

A spent daily quota answers 429 with code daily_quota_exceeded and a Retry-After that counts to midnight UTC. The quota headers are not sent on the 429 itself.

Credits

Independently of the request rate, every read is metered in credits from the workspace wallet. Cached reads are cheap; a request that collects fresh data costs more (see Credits). At the cap every metered call, cached reads included, returns 402 with code credit_cap_exceeded.