Rate Limits

Authenticated requests use an API-key hash or JWT subject bucket. Unauthenticated requests use an IP bucket. Limits apply per API machine. A stricter route limit overrides the default.

HTTP limits

• Authenticated default: 500 requests per minute per API key or JWT subject, per API machine.
• Unauthenticated default: 100 requests per minute per IP, per API machine.
• Passport issue, Passport verify, revoke-all, identity verification initiation, and /v1/webhooks/* POST routes: 20 requests per minute.
• Agent registration: 60 requests per minute. Enrollment challenge: 30 per minute. Enrollment: 10 per minute. Rotation: 30 per minute.
• Audit export: 30 requests per minute.
• Unauthenticated inbound webhook delivery uses the default 100 requests per minute per source IP, per API machine.

Allowances are separate

HTTP rate limits protect the service. The monthly action allowance and pass-through allowances are billing rules. Read them from Usage API. Do not infer a monthly quota from an HTTP limit.

429 and Retry-After

A request over its HTTP limit returns 429. Honor Retry-After when present. Add jitter to concurrent retries. Do not retry in a tight loop.