REST API Rate Limits

All /api/v1 routes share a fixed window of 120 requests per minute for each credential. Preview uploads, finalization, resource reads, build uploads, and test-run requests all count toward the same window. API keys are limited by key; session Bearer tokens are limited by user.

A rejected request returns 429:

{
  "error": "rate_limited",
  "message": "too many API requests",
  "retryAfterMs": 18342
}

The Retry-After response header contains the rounded number of seconds until the current window resets. Wait for that delay before retrying. Adding random jitter helps several workers avoid retrying at the same instant.

The request limit is enforced independently for each API key or session user. Account spending limits remain shared across every credential and every UI or CI caller, so creating more keys does not increase the account’s allowance, prepaid balance, monthly cap, or daily safety limit.