# Rate limits

> How many requests a key and a business can send, and what a 429 looks like.

Source: https://useroutegate.com/docs/concepts/rate-limits

Every call to `/api/v1` counts against two limits at once. By default:

| Limit        | Allowance               | Counts                                                                |
| ------------ | ----------------------- | --------------------------------------------------------------------- |
| Per API key  | 600 requests a minute   | Every request made with that key                                      |
| Per business | 3,000 requests a minute | Every request from all of the business's keys, test and live together |

Each limit is a bucket that holds a minute's allowance and refills continuously, so a key can burst to 600 at once and then sustains 10 a second. A request that fails authentication is answered `401` before either bucket is touched.

## Headers

A response from `/api/v1` carries the bucket it was counted against:

| Header                  | Value                                                     |
| ----------------------- | --------------------------------------------------------- |
| `X-RateLimit-Limit`     | The size of the bucket                                    |
| `X-RateLimit-Remaining` | Requests left in it right now                             |
| `Retry-After`           | On a `429` only: whole seconds until a request fits again |

A request that passes both limits reports the business bucket. A `429` reports the bucket that ran out.

## When you are limited

The answer is `429` with the code `RATE_LIMITED`:

```json
{
  "success": false,
  "code": "RATE_LIMITED",
  "message": "Too many requests",
  "data": null
}
```

Wait `Retry-After` seconds and send the request again. A `429` is answered before the `Idempotency-Key` is read, so a vend that was limited was not placed: retry it with the same key and the same body.