Skip to main content
The v2 API enforces rate limits per team. Before a request is authenticated (when the key can’t yet be resolved to a team), the limiter falls back to per-IP.

Response headers

Most v2 API responses, whether 2xx or not, carry three headers. The unauthenticated /v2/openapi.json document is an exception. Use X-RateLimit-Remaining to pace yourself proactively — dropping to 0 triggers 429 on the next call.

Handling 429

When you exceed the budget, v2 answers 429 Too Many Requests with the shared error envelope and a Retry-After: <seconds> header:
Wait at least Retry-After seconds before retrying. In practice, back off exponentially with jitter and cap the wait at a few minutes.
/v2/openapi.json is not rate-limited — the OpenAPI document is static and safe to fetch freely.