Requests are limited to 100 per minute per token. Exceeding that returns
429 with a Retry-After header:
{ "success": false, "error": "Rate limit exceeded", "data": null }Repeated authentication failures are limited separately, by IP, at 10 per
minute. Successful requests never count toward it, so a busy integration is
unaffected no matter how much traffic it sends.
Limits are enforced per edge location and are deliberately permissive:
they exist to stop a runaway loop, not to meter usage. If you expect sustained
traffic beyond this, talk to us rather than working around it.
Responses in production carry Cache-Control and an ETag. Reference data is
cacheable for an hour, a DJ profile for five minutes, and search results for one
minute. Sending If-None-Match gets you a 304 and costs nothing against your
limit's usefulness — honouring these is the cheapest way to stay well inside the
limit.