Rate limits
What the gateway limiter allows, and which routes it covers.
The gateway limiter is a Redis token bucket:
- 10 tokens replenished per second
- burst capacity 20
Exceeding it returns 429. Backend limits may also apply independently, so a
429 can arrive even from a route the gateway did not throttle.
Which routes the gateway limits
| Rate-limited at the gateway | No route-level limiter |
|---|---|
| Checks | Monitoring |
| Reports and references | |
| Consent | Webhook configuration |
"No route-level limiter" does not mean unlimited — it means the gateway is not the thing limiting you.
Handling 429
Back off exponentially with jitter, and retry. Two things make retries safe:
- Send an
Idempotency-Keyon every create, so a retry cannot double-charge. - Never retry in a tight loop — a burst of 20 is consumed in well under a second and simply extends the throttle.