Rate limits
Request budgets, the X-RateLimit headers and backing off.
Each token has a budget of 120 requests per minute, over a sliding window. Normal scripts never notice it; it exists so a runaway loop cannot hammer the servers behind the API.
Headers
Every successful response carries the state of the budget:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Requests allowed in the window. |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | When the window frees up, in epoch seconds. |
Slow down when Remaining gets low. The 429 response itself does not carry these headers, so read them on the requests before it.
When you hit the limit
The API answers 429 with code: "resource_exhausted". Wait and retry with exponential backoff and jitter:
async function call(url: string, init: RequestInit, attempt = 0): Promise<Response> {
const res = await fetch(url, init);
if (res.status !== 429 || attempt >= 5) return res;
const delay = Math.min(30_000, 1000 * 2 ** attempt) + Math.random() * 250;
await new Promise((r) => setTimeout(r, delay));
return call(url, init, attempt + 1);
}Other limits
- Some endpoints have their own, tighter budget on top of the global one, for example PDF downloads and Anti-DDoS rule changes.
- Failed authentication is throttled per IP address: repeated unknown or revoked tokens from the same address get 429 for a while, even with a valid token afterwards.
Something unclear or missing? Open a ticket and the team will get back to you.