Skip to content

Rate limits

Each credential has its own quota: 120 requests per minute for a personal key, and 120 per minute per member for an OAuth app. Every answer says where you stand, in the IETF format:

RateLimit-Policy: "api-v1";q=120;w=60
RateLimit: "api-v1";r=118;t=42

q is the quota, w the window in seconds, r what is left, and t the seconds until the window resets.

When the quota is used up, the API answers 429 with RATE_LIMITED and a Retry-After header in seconds. Wait that long, then retry.

  • Revalidate. Send the ETag you got as If-None-Match. A 304 Not Modified has an empty body: nothing to download or parse again. It counts like any request.
  • Page wide. Ask for limit=200 when you walk a whole list.
  • Do not poll in a tight loop. A feed of changes, designed for keeping a copy in step, arrives in a later release.