Explore the available API endpoints in the sidebar

API Authorization & Rate Limits

To ensure optimal performance and reliability, our API employs request throttling to limit the number of requests a client can make within a specified time frame. This helps protect the API from abuse and ensures fair usage.

Throttling Rules

Scope: API requests to the api subdomain
Limit: 60 requests per 30 seconds (2 requests per second average)
Identifier: Bearer authorization key in the request header

Authorization

Our API uses Bearer tokens for authorization. Each request must include a valid API key in the Authorization header:

Authorization: Bearer <your_api_key>

Generate and manage API keys under Settings → API Keys. If you don't see that section, your role doesn't have access. Reach out to your tech lead or an admin on your team to get a key.

How It Works

Request Identification: Each request to the api subdomain is identified using the bearer token from the Authorization header.
Rate Limit: A maximum of 60 requests per 30-second window is allowed for each bearer token. This allows bursting (sending many requests quickly) while maintaining an average of 2 requests per second.
Exceeded Limit Response: When the limit is exceeded, the client receives a 429 Too Many Requests response with additional headers providing details on when they can retry.

Response Headers

When the rate limit is exceeded, the response includes the following headers:

Retry-After: Indicates the number of seconds to wait before making a new request.
X-RateLimit-Limit: The maximum number of requests allowed per second.
X-RateLimit-Remaining: The number of requests remaining in the current period.
X-RateLimit-Reset: The time when the rate limit will reset.

Example Response

If the rate limit is exceeded, the API will respond with:

{
  "error": "Throttle limit reached. Retry later."
}

With headers:

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 30
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: