REST API

Rate limits

Every organisation has a number of API calls a minute. Your plan sets it; the default is 60. All keys of the organisation share it. Calls in the admin portal do not count against it.

Every answer to a valid key carries the quota in the headers of the IETF RateLimit draft:

RateLimit-Policy: "plan";q=60;w=60
RateLimit: "plan";r=42;t=18

q is the quota and w the window in seconds. r is what is left and t the seconds until the window starts again. GET /v1/me names the limit of your plan.

When the quota is spent, the answer is 429 rate_limited with a Retry-After header in seconds. Wait that long, then retry. Do not retry at once in a loop.

The ingress also refuses more than 100 calls a second from one IP address, after an allowance of 200 extra calls. That answer is 429 rate_limited with Retry-After, but it has no RateLimit headers, because the quota of your plan was not counted.

Invalid keys

The API also counts the calls with an invalid key from each IP address. After 20 such calls, it answers 429 rate_limited to that address for each key that is not an active key of an organisation, and frees one call every 6 seconds. Every key that is not revoked or expired keeps working from that address, also after a restart of the service, so a shared address does not lock out your integration. A new key gets that exemption within 30 seconds. A valid key never uses this count, and a token that is not in the key format does not count. Check the key before you retry a 401.