Rate limits & errors

Predictable limits so you can build without guessing.

Current limits (same for everyone)

Free reads (no auth)100 req/min per IP429 with Retry-After

Authenticated (DeviceToken)100 req/min per device429 per-device

Health-check trigger (POST /v1/apis/:id/health-check)10s cooldown, 30/min per device429 + 200 CACHED or 202 QUEUED

Compare (GET /v1/apis/compare)Up to 8 APIs per request400 below 2 ids

Watchlists10 per device409 at cap

Agent keys5 active per device409 at cap

Error shape

json

{ "error": "Too Many Requests", "message": "Rate limit exceeded. Retry after 12s.", "statusCode": 429 }
{ "error": "Not Found", "message": "API not found", "statusCode": 404 }
{ "error": "Unauthorized", "message": "Access token required", "statusCode": 401 }

Headers

Retry-After on 429. Treat all 5xx as retryable with backoff.

Quotas are universal — there are no higher tiers. The 100/min read limit is enforced today (Fastify rate limiter).