Rate Limits

Policy

• Strategy: Sliding window

• Window: 1 minute

• Permit limit: 120 successful acquisitions per window

If a user exceeds the window limit, further requests are delayed (queued) up to 2. If the queue is full, requests are rejected immediately with 429 Too Many Requests (the middleware may convert some into generic error bodies depending on pipeline stage).

Counting Rules

• Authenticated requests only; anonymous requests are currently not rate limited (but will likely be in the future — do not rely on this behavior).

• WebSocket connection establishment counts as one request; messages over the WebSocket are not rate limited (server only pushes events, it does not accept client commands currently).