Skip to main content
Each organization may make 1,000 requests per minute per endpoint. The limit is a circuit breaker for runaway loops and leaked keys, set well above normal traffic, not a quota to budget around.

The response

Over the limit, requests are answered 429 for the rest of that minute:
Retry-After is the number of seconds until the current minute ends. Browsers can read it; it is exposed through CORS.

What counts

One HTTP request is one unit, whatever it carries. A batch of 200 events is one request; a batch of 50 decisions is one request. Each endpoint has its own counter, so a burst of events never blocks decisions. Test and live keys share the organization’s counters.

Staying under it

  • Batch events. Queue them and flush in batches of up to 200; the server SDK does this at five seconds or a hundred events, whichever comes first. See Batch calls.
  • Decide once per exposure, and let the client cache the result for that exposure.
  • On a 429, back off for Retry-After seconds. For decide, serve the fallback instead; the deadline has passed by the time the minute ends. For events, retry with the same ids. The server SDK honours Retry-After on event flushes.
  • A sudden 429 with no traffic change usually means a loop or a leaked key. Check the dashboard, and rotate the key if it may have leaked.