Rate Limiting

Each instance applies an hourly quota to its REST API (/api/...):

• Fixed one-hour window: the window opens with the first API request and resets one hour later.
• Not per client: all the API credentials and users of an instance count against the same quota.
• What counts: every request to /api/... counts as one call, including requests that fail (for example 401 for a missing or expired token). A batch request counts as a single call. Token requests (/oauth/v2/token) are not counted.
• No per-second limit: still, prefer batch endpoints and keep the number of simultaneous requests low.

When rate limiting is enabled on your instance, API responses carry the following headers. Read the quota from X-RateLimit-Limit rather than hard-coding a value:

Header	Description
X-RateLimit-Limit	Requests allowed in the current window
X-RateLimit-Remaining	Requests left in the current window
X-RateLimit-Reset	On a 429 response: Unix timestamp at which the window resets (on other responses it holds the current time)

When the quota is exceeded, the API returns HTTP 429, without a Retry-After header:

{
  "errors": [
    {
      "code": 429,
      "message": "You exceeded the rate limit of 15000 API calls per hour.",
      "details": []
    }
  ]
}

Wait until X-RateLimit-Reset before sending new requests — never retry in a loop.