Rate limits

Requests to /api/v1 are limited per minute:

Limit	Per minute	Counted
Per address	1,000 requests	By the caller’s IP address, as Cloudflare sees it. The OpenAPI document and /api/v1/docs count here too.
Per key	600 requests	By the API key, whichever address it comes from.
Keys that don’t work	20 per address	Requests with a key that’s unknown, deleted or expired. Past it, that address’s keys can be refused for the rest of the minute, working ones too, without being looked up.

Over any of them, the API answers:

HTTP/1.1 429 Too Many Requests
retry-after: 60
content-type: application/json; charset=utf-8

{ "error": { "code": "rate_limited", "message": "Too many requests. Slow down and try again in a minute." } }

Wait for retry-after seconds, then carry on. A write you send again after a 429 is safe with an Idempotency-Key: a refused request was never kept, so it runs as new.

The limits are checked before a key is looked up or a body is read, so a flood is refused as cheaply as it can be. X-Forwarded-For and the like are never read for a limit: a client can’t move into a bucket of its own by setting them.

Fetching a page at a time? Use the paged lists with limit=100, and webhooks instead of polling for changes.