Developers
Rate limits and errors
Two ceilings apply to the API, both counted in a sliding sixty-second window. Going over either one returns 429 rate_limited and the request is refused outright, never queued, so back off and retry rather than repeating the same call again immediately.
| Ceiling | Limit | Notes |
|---|---|---|
| Per API key | 600 requests per minute | Shared across every request that key makes, reads and writes together. |
| Per calling IP address | 1,200 requests per minute | Counted before your key is even read, so it also covers requests with a missing or invalid key. A shared egress address, such as a cloud function or an office network, shares one bucket with everyone else behind it. |
Both numbers are also shown live on Developer > API keys, so you do not have to keep this page open while you build.
| Status | Error code | What it means |
|---|---|---|
| 401 | unauthorized (see message) | The Authorization header is missing, or the key in it is invalid or revoked. |
| 403 | read_only_key (see message) | The key is valid but does not have the write scope, and the request was a POST, PATCH or DELETE. |
| 404 | not found | The resource, or the specific id inside it, does not exist in your workspace. |
| 429 | rate_limited | You went over one of the two ceilings above. Wait and retry with backoff. |
Every error response, whatever the status, is a JSON object shaped { error, message }: error is a short machine-readable code safe to branch your code on, and message is a plain sentence for a log line or a support ticket. Neither field changes shape between resources.
Was this page useful?