Limits
Rate limiting
60 requests per minute per API key, fixed window. Every response carries these headers so you can self-throttle before hitting 429:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Requests allowed per window (60). |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | Unix timestamp (seconds) when the window resets. |
Exceeding the limit returns 429 with error.code: "rate_limited".
What’s not entitlement-gated yet
Endpoints today read the same public registry data regardless of which organisation is calling — there is no per-plan quota beyond the flat rate limit above. Entitlements (limits tied to a billing plan) arrive in Phase 5, once there is a product and a plan to attach them to.
API keys
No hard cap on keys per organisation today. A key has no expiry — revoke it from Console → API Keys when it’s no longer needed.