Rate Limits

Buckets are keyed by source IP. A request that carries a Bearer credential, whatever its kind, counts against one shared bucket for its source IP, because the credential is not verified until after the limit is applied. A request without one uses a separate, smaller IP bucket. Limits apply per API machine. A stricter route limit overrides the default.

HTTP limits

• Requests with a Bearer credential: 500 requests per minute per source IP, shared by every API key, JWT and OAuth token behind that IP, per API machine.
• Requests without a Bearer credential: 100 requests per minute per source IP, per API machine.
• Passport issue, Passport verify, revoke-all, identity verification initiation, and /v1/webhooks/* POST routes: 20 requests per minute.
• Agent registration: 60 requests per minute. Enrollment challenge: 30 per minute. Enrollment: 10 per minute. Rotation is enrollment with force=true and shares that limit: 10 per minute.
• Audit export: 30 requests per minute.
• Inbound webhook delivery: 100 requests per minute per slug and source IP pair, per API machine.

Allowances are separate

HTTP rate limits protect the service. The monthly action allowance and pass-through allowances are billing rules. Read them from Usage API. Do not infer a monthly quota from an HTTP limit.

429 and Retry-After

A request over its HTTP limit returns 429. Honor Retry-After when present. Add jitter to concurrent retries. Do not retry in a tight loop.