Start
Rate limits
Per-workspace ceilings by plan, the headers that report them, and what a 429 looks like.
Limits are counted per workspace, not per IP address. Adding a machine does not raise the ceiling; sharing an office network does not lower it. The MCP server counts against the same budget as REST.
Ceilings
| Plan | Per minute | Per UTC day |
|---|---|---|
| Growth | 120 | 40,000 |
| Scale | 600 | 200,000 |
| Starter and trial | 30 | 2,000 |
Only Growth and Scale include API access today, so the Starter row is the budget a key would have rather than one you can use. The daily counter resets at UTC midnight.
Headers
Every response from a keyed route carries the ceiling. The remaining count is present only when it was measured; a missing header means the counter could not be read, not that it is zero.
| Header | Value |
|---|---|
X-RateLimit-Scope | workspace |
X-RateLimit-Limit-Minute | The per-minute ceiling for the plan |
X-RateLimit-Limit-Day | The daily ceiling |
X-RateLimit-Remaining-Day | Requests left today, when known |
When you hit one
Both cases answer 429. The body is the flat shape, not the { error } envelope, and names how long to wait.
{
"statusCode": 429,
"code": "public_api_rate_limited",
"message": "This workspace has made 120 public API requests in the last minute, which is the ceiling. ...",
"perMinute": 120,
"retryAfterSeconds": 17
}{
"statusCode": 429,
"code": "public_api_daily_cap_reached",
"message": "This workspace has made all 40000 of its public API requests for today on the growth plan. ...",
"used": 40000,
"limit": 40000,
"plan": "growth",
"retryAfterSeconds": 21600
}Sleep for retryAfterSeconds and retry. Writes are safe to retry when you sent an Idempotency-Key; see Idempotency.
If the rate counter itself is unreachable the API serves the request and logs it. A counter outage never takes an integration offline.