​
Rate Limiting

The API enforces rate limits at three scopes (per-IP, per-user, per-endpoint). Limits live in the backend plan §7.4; per-endpoint specifics are noted on each reference page.

​
Headers returned

On every response that’s subject to rate limiting:
HeaderMeaning
X-RateLimit-LimitRequests allowed in the current window
X-RateLimit-RemainingRequests left in the window
X-RateLimit-ResetUnix epoch (seconds) when the window resets
On a 429 RATE_LIMITED:
HeaderMeaning
Retry-AfterSeconds to wait before retrying

​
Defaults

  • Unauthenticated routes: 60 req / 1 min / IP.
  • Authenticated REST routes: 600 req / 1 min / user.
  • Auth endpoints (/auth/login, /auth/register/*, /auth/refresh): 10 req / 1 min / IP.
  • File-upload endpoints: 20 req / 1 min / user.
Endpoints can override these — the per-endpoint reference page is the source of truth.