Rate limits

Authenticated public API requests are rate limited per workspace. Requests made with any valid key for the same workspace share the same bucket, so creating more keys does not increase the limit. The public OpenAPI schema at /api/v1/openapi.json is not rate limited.

Current default limits:

Repeated invalid API-key attempts are limited separately to 120 requests per minute and 10,000 requests per day per source IP.

Response headers

Successful limited requests include headers for the currently binding window:

When you hit the limit

If either the minute or day window is exhausted, the API returns 429 TOO_MANY_REQUESTS:

{
  "error": {
    "code": "TOO_MANY_REQUESTS",
    "message": "Rate limit exceeded",
    "requestId": "b98f2fc3-..."
  }
}

{
  "error": {
    "code": "TOO_MANY_REQUESTS",
    "message": "Rate limit exceeded",
    "requestId": "b98f2fc3-..."
  }
}

The response also includes Retry-After, in seconds. Wait at least that long before retrying. Include requestId when contacting aclipp support.

Client guidance

• Treat Retry-After as authoritative for 429 responses.
• Add backoff and jitter when retrying automated jobs.
• Cache stable reads, especially project configuration and metadata lists.
• Paginate list requests instead of making many narrow repeated calls.

MCP server

The MCP server has its own limits and does not use up the workspace's REST API limit. They count per person instead of per workspace: OAuth connections count against the signed-in user, across all of their connections, and each API key has its own bucket.

MCP responses carry the same X-RateLimit-* headers. Over the limit, the server answers 429 with Retry-After and a JSON-RPC error body, so clients see a throttled call instead of a broken connection:

{
  "jsonrpc": "2.0",
  "error": { "code": -32000, "message": "Rate limit exceeded" },
  "id": null
}

{
  "jsonrpc": "2.0",
  "error": { "code": -32000, "message": "Rate limit exceeded" },
  "id": null
}