Rate limits

Limits are applied per API key. All authenticated endpoints share these windows:

Window	Limit
Per minute	60 requests
Per hour	1,000 requests

Creating exports is more expensive, so POST /exports carries an additional 5 requests/hour per key.

Rate-limit headers

Every authenticated response reports the current status:

Header	Meaning
`X-RateLimit-Limit`	The request limit for the current window
`X-RateLimit-Remaining`	Requests remaining in the current window
`X-RateLimit-Reset`	Unix timestamp (seconds) when the window resets

The API returns 429 with code rate_limited and a Retry-After header (seconds until you can retry):

{
  "success": false,
  "error": "Rate limit exceeded",
  "code": "rate_limited",
  "request_id": "req_..."
}

Back off until Retry-After elapses, then retry. A simple exponential backoff that respects Retry-After is the recommended client behavior.

Alongside the rate-limit headers, every response carries:

Header	Meaning
`X-Request-ID`	Unique request identifier — include it in support requests
`X-API-Version`	The API version that served the request (`2026-07-01`)