Rate limits and errors
The request quota per credential, the rate-limit response headers, and the JSON error envelope used across the REST API.
Rate limits
Every /api/v1/* request is checked against a sliding-window limit scoped to your credential (API key or OAuth token — both share the same limiter):
| Limit | Window | Applies to |
|---|---|---|
| 100 requests | per minute | Per API key / OAuth token (/api/v1/* and /api/mcp) |
This limit is a currently-deployed default, not a per-plan configurable — if you need a higher ceiling for a specific integration, contact support.
Every response carries the current state of your quota:
X-RateLimit-Limit: 100 X-RateLimit-Remaining: 99 X-RateLimit-Reset: 1725292860
X-RateLimit-Reset is a Unix timestamp (seconds) for when the window resets.
Exceeding the limit
{
"error": "Rate limit exceeded",
"status": 429,
"requestId": "req_abc123",
"timestamp": "2026-09-02T18:00:00.000Z",
"retryAfter": 12
}
429 responses also carry a Retry-After header (seconds). Back off for at least that long before retrying.
Error shape
All non-2xx responses use the same envelope:
{
"error": "Unauthorized",
"status": 401,
"timestamp": "2025-11-03T18:00:00.000Z",
"requestId": "req_abc123",
"message": "Invalid API key"
}
message and details are present when there's more to say than the top-level error string (e.g. Zod validation failures list the offending fields in message).
Common status codes
| Code | Meaning |
|---|---|
200 | Success |
201 | Resource created |
204 | Success, no content (delete, some updates) |
400 | Invalid request body or query parameters |
401 | Missing or invalid credential |
402 | Plan limit exceeded (e.g. property/contact count on the account's plan) |
403 | Insufficient scope, or plan doesn't include API/feature access |
404 | Resource not found |
409 | Optimistic-locking version conflict, or a concurrent idempotent retry still in flight |
413 | Request or file too large |
429 | Rate limit exceeded |
500 | Internal error |
502 | Upstream/storage failure (e.g. no image could be stored) |
Every response also carries X-Request-Id — include it when reporting an issue so support can find the exact request in the logs.