API
Rate limits
How Arrota limits API requests per key, the headers that report your limit, and how to handle 429 responses.
Updated
On this page
Limits per API key
Each API key has its own limit per minute, set by your organisation's plan:
| Plan | Requests per minute, per key |
|---|---|
| Starter, Growth | 60 |
| Pro | 240 |
| Scale | 600 |
Limits apply to all /api/v1 endpoints together. A separate limit also applies per network address before a key is checked, to protect the API from unauthenticated traffic.
Headers
Every response reports the limit that applies to it:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Requests allowed in the current window. |
X-RateLimit-Remaining | Requests left in the current window. |
X-RateLimit-Reset | When the window resets, in Unix epoch seconds. |
When you hit the limit
The API returns 429 with a Retry-After header, in seconds:
{ "error": "Rate limit exceeded for this API key." }Wait at least Retry-After seconds before sending the next request. Use X-RateLimit-Remaining to slow down before you reach zero, and use limit=100 when paging through credentials. See Pricing for plans.