Rate limits
| Surface | Limit |
|---|---|
| Authenticated API | 600 requests per minute per credential |
| Public GET | 240 per minute per IP and form |
| Public submissions | 120 per minute per IP and form (60 default for other POSTs) |
| OAuth token and revoke | 30 per minute per IP |
Headers
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (unix seconds). A 429 adds Retry-After in seconds. Back off exponentially and honor it.
Idempotency
Send an Idempotency-Key header on POST. Replays within 24 hours return the original response with Idempotent-Replayed: true; reusing a key with a different body returns 409.