Rate limits
Clients should respect Retry-After and RateLimit-* headers.
| Scope | Window | Limit |
|---|---|---|
| Auth endpoints | 15 minutes | 30 requests |
| Public/general API | 1 minute | 300 requests per IP |
| Protected API | 1 minute | 600 requests per authenticated user, then tenant/IP fallback |
| Tenant writes | 1 minute | 180 write requests per tenant |
| Enrichment/Dossier | 1 minute | 10 requests per tenant |
| Concurrent tenant requests | Immediate | 50 in-flight requests |
Rate-limited responses use HTTP 429.
Retry-After: 5
RateLimit-Limit: 600
RateLimit-Remaining: 0
RateLimit-Reset: 1790000000
Client behavior
- Retry only after
Retry-After. - Use exponential backoff for repeated 429 responses.
- Avoid parallel fan-out that exceeds the tenant concurrency cap.
- Prefer pagination over bulk reads.
- For imports, keep write concurrency bounded and treat
Retry-Afteras authoritative. Tenant write limits are configurable by deployment throughTENANT_WRITE_RATE_LIMIT_MAXandTENANT_WRITE_RATE_LIMIT_WINDOW_MS.