Rate limits
Each API key gets a set number of requests per minute, by its tier, and responses usually say how many are left.
Requests count against a limit per minute. Under /v1, a request with an API key counts against that key's tier (keys start on standard), and one without a key counts against its IP address. Outside /v1, every request counts against its IP address, even one that sends a key. The health checks and a few public reads aren't limited.
| Caller | Requests per minute |
|---|---|
An API key on the standard tier | 100 |
An API key on the elevated tier | 500 |
An API key on the unlimited tier | 10,000 |
| No API key, per IP address | 20 |
These are the general limits. Some operations also have a tighter quota of their own, counted per key (or signed-in member) and per organization, so they can return 429 before the key reaches its tier's limit. While SDP's counter store is unavailable, those operations refuse with 503 rather than run uncounted.
Responses usually say where you stand. The headers are left off while SDP's shared counter store is unavailable, so don't depend on them:
| Header | Means |
|---|---|
X-RateLimit-Limit | Requests allowed per window |
X-RateLimit-Remaining | Requests left in this window |
X-RateLimit-Reset | When this window ends, in Unix seconds |
Past the limit, a request gets 429 with the code RATE_LIMITED and a Retry-After header. Wait that many seconds before you send it again.