Rate limits

| Endpoint family | Limit | Window | |---|---|---| | Public (no auth) | 60 requests | per minute per IP | | Tenant-scoped (platform_session) | 600 requests | per minute per tenant | | Admin (admin_session) | 1,200 requests | per minute per user | | Webhooks inbound | 240 events | per minute per source | | Auth (login, register, password reset) | 30 attempts | per 15 minutes per IP |

Enterprise contracts can raise any of these.

HTTP/1.1 429 Too Many Requests
Retry-After: 17
Content-Type: application/json

{ "error": "Rate limit exceeded", "retryAfterSeconds": 17 }

The Retry-After header is always set (whole seconds). Back off until it elapses; further requests before then return 429 again without resetting the timer.

• Don't poll faster than necessary. Most list endpoints accept since= query params; use that instead of full re-fetches.
• Respect Retry-After exactly — don't half-back-off. The server will tell you when the door opens.
• Spread parallel requests across a sliding window — a burst of 60 in one second hits the per-minute IP limit for the rest of the minute.
• Authenticate. Authenticated requests get a 10× higher limit than anonymous.