Authenticated API requests are rate limited per user with a drip-refill token bucket. Short bursts are allowed up to the bucket capacity; tokens then refill steadily so normal lower-volume traffic can continue without waiting for a hard window reset.
Limits apply separately to GET and POST requests. Unauthenticated requests are not counted against these buckets.
| Method | Burst capacity | Refill rate |
|---|---|---|
GET |
500 requests | 3 per second |
POST |
20 requests | 30 per minute |
When a limit is exceeded, the API returns a JSON error response:
{
"success": false,
"errors": [
"You have exceeded the rate limit. Please wait a moment and try again."
]
}