developer-rate-limits.md
Every request is metered per API key at the gateway, on two limits at once: a sustained rate in requests per second , and a rolling daily quota. Exceeding either returns 429.
| Tier | Rate | Burst | Daily quota |
|---|---|---|---|
| Free (keyless) | 5 req/s | 10 | 1,000 |
| Starter (free, GitHub sign-in) | 20 req/s | 40 | 10,000 |
| Pro ($49/mo) | 100 req/s | 200 | 100,000 |
| Business ($199/mo) | 400 req/s | 800 | 1,000,000 |
A request with no key is metered on the Free tier. See plans for what each tier unlocks and authentication for how to send a key.
The quota window is a rolling 24 hours enforced by the gateway — not a calendar month. The rate limit is a token bucket: short bursts above the sustained rate are tolerated up to the burst ceiling before throttling engages.
Every response carries the policy for the tier that served it:
Code
`RateLimit-Policy: "quota";q=1000;w=86400, "burst";q=5;w=1
X-RateLimit-Limit: 1000
X-RateLimit-Window: 86400
X-RateLimit-Tier: free`
RateLimit-Policy follows the RFC 9331 quota-policy syntax — q is the quota, w the window in seconds. Browser clients can read all four; they are named in Access-Control-Expose-Headers.
RateLimit-Remaining and RateLimit-Reset are deliberately not sent. Those describe the state of a counter, and the counter lives in the API gateway, which does not expose it to the application. We would have to invent the number, in a header you are meant to trust. Pace against the policy above and treat a 429 as authoritative.
| Code | Meaning |
|---|---|
429 | Rate limit or daily quota exceeded. Back off and retry. |
402 | The resource is above your tier. Not a rate limit — see plans. |
503 | Upstream unavailable. Retry with backoff. |
Retry-After is not currently sent on 429. Use exponential backoff with jitter against the published policy rather than waiting for a header.
Independently of per-key metering, traffic is protected at the CDN edge: abusive request rates from a single IP are throttled, and known-bad IP ranges are blocked. Normal browsing and scripted discovery are well within those bounds.
cache-control: public, max-age=300); repeated identical queries are cheap. Cache on your side where you can.page + limit (max limit=100) instead of pulling large result sets.artifact_types you need, and add include=content only when you actually need the bytes (OpenAPI specs are large).Last modified on August 21, 2026