Budgets
Every endpoint is rate limited except
GET /health.
How requests are counted
Each request is checked twice: once by network address before authentication, and once by verified identity after it. So every request, even an authenticated one, also counts against the 600-per-minute budget of the address it came from. That is enough for five API keys or people behind one address to each use their full 120. Other things to know:- Each API key has its own budget, so one busy integration cannot exhaust another’s, unless both call from the same network address and so share its budget.
- The widget has its own budgets, separate from API traffic. Each visitor is counted by the network address their requests come from, so visitors behind one address, such as an office network, share 20 requests a minute on one embed.
- MCP requests count against the API key’s budget and also against a separate MCP budget of the same size.
- A streaming answer costs one request. Its events are not counted individually.
- Every request costs the same, whether it lists assistants or generates an answer.
Handling 429
A rate-limited request returns:- Wait the number of seconds in
Retry-After, then retry. Retry-Afteris omitted when no wait is known. Fall back to exponential backoff with jitter.- Never retry in a tight loop; that consumes the budget you need to recover.
- Read the body’s
codebefore you wait. A429withquota_exceededis the monthly answer limit, and itsRetry-Aftercan be weeks: do not retry it.
Quotas
Rate limits bound requests per minute. Separately, each organisation has a monthly answer allowance: once it is used, a request that asks a question is refused with429 and the code quota_exceeded until the next calendar month. That refusal is not a rate limit and must not be retried on a timer. See Usage and limits and Errors.