Rate Limits
A caller holding a key is metered per key. Two limits apply at once — a sustained rate in
requests per second and a rolling daily quota — and exceeding either returns 429.
| Tier | Rate | Burst | Daily quota |
|---|---|---|---|
| Learn (free, GitHub sign-in) | 20 req/s | 40 | 2,000 |
| Understanding ($199/mo) | 100 req/s | 200 | 10,000 |
| Influence ($499/mo) | 400 req/s | 800 | 25,000 |
| Explore (an agent principal's own key) | 5 req/s | 10 | 500 |
See plans for what each tier unlocks and authentication for how to send a key.
The quota window is a rolling 24 hours enforced by the gateway — not a calendar month. The rate limit is a token bucket: short bursts above the sustained rate are tolerated up to the burst ceiling before throttling engages.
Keyless callers are limited per IP, not per plan
A request with no key is not metered by a usage plan at all. It is rate limited per IP address at the edge, at 3,000 requests per 5 minutes.
This is a real distinction rather than a technicality, and it is worth understanding before you build against it. A usage plan meters per API key, so every anonymous caller in the world would have to share one key — and therefore one quota. A per-caller number in that arrangement is not something the design can deliver, whatever it says on a page. So keyless access is limited by the thing that can tell anonymous callers apart, which is their address.
Two consequences:
- Your keyless limit is not affected by anyone else's traffic, which is the opposite of what a shared quota would give you.
- Identifying yourself gets you your own meter. A Learn key is free, and an agent that signs its requests can take a principal with its own key and quota — see onboarding. That is what a key buys before it buys any extra volume.
Reading the limit from a response
Every response carries the policy for the tier that served it:
Code
RateLimit-Policy follows the RFC 9331 quota-policy syntax — q is the quota, w the window in
seconds. Browser clients can read all four; they are named in Access-Control-Expose-Headers.
RateLimit-Remaining and RateLimit-Reset are deliberately not sent. Those describe the state
of a counter, and the counter lives in the API gateway, which does not expose it to the application.
We would have to invent the number, in a header you are meant to trust. Pace against the policy
above and treat a 429 as authoritative.
Status codes
| Code | Meaning |
|---|---|
429 | Rate limit or daily quota exceeded. Back off and retry. |
402 | The resource is above your tier. Not a rate limit — see plans. |
503 | Upstream unavailable. Retry with backoff. |
Retry-After is not currently sent on 429. Use exponential backoff with jitter against the
published policy rather than waiting for a header.
Edge protection
Traffic is also protected at the CDN edge, independently of per-key metering: request rates from a single IP are limited to 3,000 per 5 minutes, and known-bad IP ranges are blocked. Normal browsing and scripted discovery are well within that.
For a keyless caller this is not merely a backstop — it is the limit, per the section above.
Be a good citizen
- Cache — responses are cacheable at the edge (
cache-control: public, max-age=300); repeated identical queries are cheap. Cache on your side where you can. - Paginate — use
page+limit(maxlimit=100) instead of pulling large result sets. - Select artifacts — request only the
artifact_typesyou need, and addinclude=contentonly when you actually need the bytes (OpenAPI specs are large).