Rate limits

The Public API enforces rate limits to ensure fair usage and system stability. Exceeding the limit returns 429 Too Many Requests.

Defaults

By default, the gateway allows 180 requests per 60 seconds per client IP (x-forwarded-for). Override via PUBLIC_API_RATE_LIMIT_MAX and PUBLIC_API_RATE_LIMIT_WINDOW_MS. This is enforced in public-api-gateway (not Cloud Armor).

Response headers

Every response includes x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset. When rate limited, the response also includes Retry-After (seconds until the window resets). Implement backoff and respect these headers when retrying.

Best practices

• Batch requests where possible; use list endpoints with limit and page.
• Cache responses when data does not change frequently.
• Use webhooks for real-time events instead of polling.