Rate limits

The API enforces two rate limits, signaled by headers on every response.

Limit	Default	Scope
Requests	500 / minute	Per key or per IP
Authentication	20 / minute	Sensitive routes (login, token exchange)

Response headers

Example

X-RateLimit-Limit: 500
X-RateLimit-Remaining: 498
X-RateLimit-Reset: 60
X-RateLimit-Limit-Auth: 20
X-RateLimit-Remaining-Auth: 18

Beyond the quota the API returns 429 Too Many Requests with a Retry-After header (seconds). Space your calls or implement exponential backoff.

To monitor several services, one GET /v1/services call beats one call per service.