Conventions

Rate limits

Requests are throttled per API key, with separate budgets for reads and writes.

Bucket	Applies to	Limit
Reads	Every request, including writes (a write counts against both buckets).	120 / minute
Writes	`POST`/`PATCH`/`DELETE` endpoints only.	30 / minute

Each API key gets its own bucket. A request with no key, or an unknown/revoked/expired one, draws from a shared bucket keyed by IP address instead. An invalid credential never earns its own private allowance.

Headers

Every response carries your current standing for the bucket it was throttled against:

Header	Meaning
X-RateLimit-Limit	The bucket's limit (120 or 30).
X-RateLimit-Remaining	Requests left in the current window.
Retry-After	Seconds to wait before retrying. Only present once you've been throttled.
X-RateLimit-Reset	Unix timestamp when the window resets. Only present once you've been throttled.

Exceeding the limit

Once a bucket is exhausted, requests get a 429 with the standard error envelope:

{
  "error": {
    "type": "rate_limited",
    "message": "Too many requests."
  }
}

Reads and writes are independent: a key that's exhausted its write budget can still make read requests until the read bucket runs out too.