Rate limits

API endpoints are rate-limited with fixed windows.

Limits by endpoint

Endpoint Category	Limit	Window	Key
SDK payment endpoints (`/request`, `/execute`, `/approve`, `/confirm`)	60 requests	1 minute	Per agent
SDK read endpoints (`/wallets`, `/transactions`, `/policies`, `/setup`)	120 requests	1 minute	Per agent
Auth endpoints (login, register)	10 requests	5 minutes	Per IP
Auth endpoints, per account (applies with the per-IP limit)	5 requests	5 minutes	Per account
Dashboard and organization API endpoints	100 requests	1 minute	Per IP

Response headers

Rate-limited responses, and SDK responses from endpoints that report usage, include these headers:

Header	Description
`X-RateLimit-Remaining`	Requests remaining in the current window
`X-RateLimit-Reset`	ISO 8601 timestamp when the window resets
`Retry-After`	Seconds to wait (only present when rate limited)

Rate limited response

A rate-limited request returns HTTP 429:

{
  "error": "Rate limit exceeded. Please slow down your requests.",
  "code": "RATE_LIMITED",
  "retryAfter": 12
}

Limiter unavailable

If the rate-limit store is unavailable, payment and write requests fail closed with HTTP 503 and code SERVICE_UNAVAILABLE. Some read endpoints fall back to a smaller in-memory limit instead. A 503 here does not mean you exceeded a quota. Retry after a short delay.

Retry strategy

The SDK retries 429 and 5xx responses only for read-only calls and writes protected by stable idempotency. It never retries payment execution, protocol records, or admin mutations. Reconcile their status before trying them again. See retry strategy for the SDK’s retry limits and backoff. For manual retries, wrap only read-only or explicitly idempotent operations. Never use a generic retry wrapper around payment execution or another non-idempotent write.

async function retryOnRateLimit(fn: () => Promise<Response>, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    const response = await fn();
    if (response.status === 429) {
      const retryAfter = parseInt(response.headers.get('Retry-After') || '5', 10);
      await new Promise((r) => setTimeout(r, retryAfter * 1000));
      continue;
    }
    return response;
  }
  throw new Error('Rate limited after max retries');
}

API

SDK and tools

Policy rules

Limits by endpoint

Response headers

Rate limited response

Limiter unavailable

Retry strategy

​Limits by endpoint

​Response headers

​Rate limited response

​Limiter unavailable

​Retry strategy

Limits by endpoint

Response headers

Rate limited response

Limiter unavailable

Retry strategy