Laboratory › Developers › Rate limits

Rate limits

Static documents served from a CDN. There is no origin capacity to protect and no per-request cost to meter, so a limit would be theatre.

The contract it will honour

Written down now, while nothing depends on it, so it cannot be invented differently later under pressure to ship.

• RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset on every response; Retry-After on a 429.
• Budgets attach to a credential where one exists and to a network address otherwise.
• Expensive endpoints carry their own separate budget rather than drawing down the general one.
• A rate limit is an operational control. It is not a quality signal, and being limited says nothing about a claim.

The headers, when they exist

RateLimit-Limit: 1000
RateLimit-Remaining: 994
RateLimit-Reset: 3600
Retry-After: 42          # only on a 429

A rate limit is not a quality signal

Being limited says nothing about a claim, and a higher budget would never accompany better evidence. Rate limits are operational controls over infrastructure. They sit on the same side of the line as uptime and cache headers, and on the opposite side from anything that bears on whether a finding is true.