Rate limits

Per-token, per-user, and per-IP request limits.

The Campaign Agent API enforces three independent rate limits. All three stack on the same request.

Every authenticated request is checked against all three limits. A single client IP must stay within 120 requests per minute regardless of which token it uses.

Response headers

Every successful response includes:

RateLimit-Limit: 600
RateLimit-Remaining: 599
RateLimit-Reset: 60

• RateLimit-Limit — maximum requests allowed in the current window
• RateLimit-Remaining — requests remaining in the window
• RateLimit-Reset — seconds until the window resets

When you hit a limit

Requests that exceed a limit return 429 Too Many Requests:

HTTP/1.1 429 Too Many Requests
Retry-After: 30
Content-Type: application/json

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded.",
    "requestId": "req_01H..."
  }
}

Wait Retry-After seconds before retrying. Do not retry inside a tight loop.

Safe retries

For network errors and 5xx responses, retry with exponential backoff (for example: 1s, 2s, 4s, 8s, capped at 30s) and a small jitter. Give up after 5 attempts. Never retry on 4xx responses other than 429.