Nar Rate Limits

NAR publishes no rate-limit documentation for the M1 Gateway External API - neither the Swagger 2.0 document nor the Postman collection mentions throttling, and no 429 response is declared anywhere. The gateway nevertheless advertises a live rate-limit budget in response headers on every request, including unauthenticated 401s, which is where these values come from. The header set is the ASP.NET Core AspNetCoreRateLimit convention: X-Rate-Limit-Limit carries the window ("600s"), X-Rate-Limit-Remaining the calls left in it, and X-Rate-Limit-Reset the ISO-8601 instant the window rolls. Observed twice on 2026-07-26 with a remaining count of 5999 against a 600-second window, implying a 6,000-request budget per 10 minutes on the unauthenticated path; the authenticated per-partner budget is not observable without NAR-issued credentials.