Rate Limits
Every request is metered per API key at the gateway, on two limits at once: a sustained rate in
requests per second, and a rolling daily quota. Exceeding either returns 429.
| Tier | Rate | Burst | Daily quota |
|---|---|---|---|
| Free (keyless) | 5 req/s | 10 | 1,000 |
| Starter (free, GitHub sign-in) | 20 req/s | 40 | 10,000 |
| Pro ($49/mo) | 100 req/s | 200 | 100,000 |
| Business ($199/mo) | 400 req/s | 800 | 1,000,000 |
A request with no key is metered on the Free tier. See plans for what each tier unlocks and authentication for how to send a key.
The quota window is a rolling 24 hours enforced by the gateway — not a calendar month. The rate limit is a token bucket: short bursts above the sustained rate are tolerated up to the burst ceiling before throttling engages.
Reading the limit from a response
Every response carries the policy for the tier that served it:
Code
RateLimit-Policy follows the RFC 9331 quota-policy syntax — q is the quota, w the window in
seconds. Browser clients can read all four; they are named in Access-Control-Expose-Headers.
RateLimit-Remaining and RateLimit-Reset are deliberately not sent. Those describe the state
of a counter, and the counter lives in the API gateway, which does not expose it to the application.
We would have to invent the number, in a header you are meant to trust. Pace against the policy
above and treat a 429 as authoritative.
Status codes
| Code | Meaning |
|---|---|
429 | Rate limit or daily quota exceeded. Back off and retry. |
402 | The resource is above your tier. Not a rate limit — see plans. |
503 | Upstream unavailable. Retry with backoff. |
Retry-After is not currently sent on 429. Use exponential backoff with jitter against the
published policy rather than waiting for a header.
Edge protection
Independently of per-key metering, traffic is protected at the CDN edge: abusive request rates from a single IP are throttled, and known-bad IP ranges are blocked. Normal browsing and scripted discovery are well within those bounds.
Be a good citizen
- Cache — responses are cacheable at the edge (
cache-control: public, max-age=300); repeated identical queries are cheap. Cache on your side where you can. - Paginate — use
page+limit(maxlimit=100) instead of pulling large result sets. - Select artifacts — request only the
artifact_typesyou need, and addinclude=contentonly when you actually need the bytes (OpenAPI specs are large).