Rate Limits

The API enforces two independent, additive rate limits to resist abuse, enumeration, and accidental overload.

The per-clientId limit is additional to and independent of the global per-IP limit. A request must satisfy both to proceed. Before an app is authenticated, the per-client limiter falls back to keying by IP.

Response when limited

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded.",
    "retryAfterSeconds": 42
  }
}

Best practices

• Back off for at least retryAfterSeconds before retrying.
• Cache responses where appropriate rather than re-fetching unchanged data.
• Paginate efficiently — use the maximum pageSize (100) for large lists.
• Spread load — avoid bursts; smooth your request rate across the window.