Rate limits
Respect organization-wide REST API limits and retry failed requests safely.
Production REST API limits are organization-wide sliding windows of 60 seconds. Every plan reaches the REST API. The limits are currently 60 requests per minute for Free, 120 for Hobby, 300 for Standard, 600 for Pro, and 1,000 for Enterprise. An organization with no subscription gets the Free limit. A request made with an OAuth access token (see REST API authentication) counts against the same organization limit as the organization's API keys. Treat the limits as a constraint of your integration. Do not spread your calls across workers that do not coordinate with each other.
A sandbox workspace gets 30 requests per minute, and reaches only some endpoints until a person claims it. See REST API: agent sign-up for the rest of that plan's limits.
Successful responses from API-key-authenticated REST endpoints include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset when the organization limiter is in effect. When a request passes through multiple buckets, the headers describe the enforced bucket closest to refusing. X-RateLimit-Reset is a Unix timestamp in milliseconds. If these headers are absent from an authenticated endpoint's successful response, do not assume unlimited quota; keep conservative local pacing. Public v1 endpoints such as POST /agent/sign-up and POST /agent/verify enforce their own internal buckets but do not add rate-limit headers to successful responses. When the API limits your request, it returns 429 with RATE_LIMIT_EXCEEDED and a Retry-After value in seconds. Centralize backoff in the service that owns your API key. Honor the Retry-After value. Add jitter so that concurrent jobs do not resume at the same time.
Reduce unnecessary traffic before you increase concurrency. Cache stable reads. Page through lists instead of restarting them. Poll asynchronous work at a fixed interval. Batch your follow-up processing. Local development does not always enforce production rate limits, because it can lack the backing services. Test the recovery path and the happy path.