Budgets
Every endpoint is rate limited except
GET /health.
How requests are counted
Each request is checked twice: once by network address before authentication, and once by verified identity after it. So every request, even an authenticated one, also counts against the 20-per-minute budget of the address it came from. Other things to know:- Each API key has its own budget, so one busy integration cannot exhaust another’s.
- The widget has its own budget, separate from API traffic.
- MCP requests count against the API key’s budget and also against a separate MCP budget of the same size.
- A streaming answer costs one request. Its events are not counted individually.
- Every request costs the same, whether it lists assistants or generates an answer.
Handling 429
A rate-limited request returns:- Wait the number of seconds in
Retry-After, then retry. Retry-Afteris omitted when no wait is known. Fall back to exponential backoff with jitter.- Never retry in a tight loop; that consumes the budget you need to recover.