Rate Limits
Rate Limits
Limits apply separately to each API key or OAuth connection.
The limits
- 3,000 requests per UTC clock hour for each key or agent connection.
- Burst: up to 10 requests per second, with additional burst protection.
This is a fixed clock-hour bucket, not a rolling hour. OAuth registration and other public protocol endpoints have separate IP-based limits.
Headers
Authenticated responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Reset is a Unix time in seconds. A 429 includes Retry-After in seconds. Authentication failures may occur before request-limit headers are available.
Over the limit
On 429 rate_limit_exceeded, wait at least Retry-After before trying again. Spread large syncs across the window. Keep a write’s original Idempotency-Key on retries.
Daily caps
Supported writes are capped at 500 units per area per connection per UTC day. Most actions count as one; messages count each selected family. A broadcast can name at most 50 families. At most 25 owner-approval proposals may remain open per connection; expired slots are cleared when new requests are reserved.
Exceeding these limits returns daily_write_limit or proposal_limit. Daily write reservations count proposed/attempted operations as well as successful changes.