API

Rate limits

Ten requests a minute, per account, on a sliding window.

The budget

Per account, not per key. All five of your keys draw on one budget of ten requests a minute. That is the point: a per-key limit would be a formality anyone could opt out of by pressing “create key” four more times.

The window slides rather than resetting on the minute. A fixed bucket would let ten requests land at 11:00:59 and ten more at 11:01:00 — twenty in a second, which is the burst the limit exists to prevent. In practice this means the budget frees up gradually as your oldest requests age out, rather than all at once.

Every response tells you where you stand

Response headers

X-RateLimit-Limit: 10
X-RateLimit-Remaining: 7
X-RateLimit-Reset: 1787661586
Retry-After: 35

X-RateLimit-Limit — the ceiling. Currently always 10.
X-RateLimit-Remaining — requests left in the window, after this one.
X-RateLimit-Reset — Unix seconds at which the oldest request in the window ages out.
Retry-After — seconds to wait. Sent on 429 only.

The first three are on every response, not just refusals, so a client can slow down before it is cut off. Status reports the same budget as JSON.

When you go over

429 · rate_limited

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit of 10 requests per minute exceeded. Retry in 35s.",
    "retryAfter": 35
  }
}

Wait the interval, then retry. Retrying immediately makes it worse: on a sliding window a retry inside the window both fails and counts against it.

Staying inside it

Poll once, not per board.List jobs is already cross-board — one call with addedAfter answers “what is new anywhere”, where a loop over 30 boards is 30 requests and three minutes of waiting.
Ask for a bigger page. limit=100 is one request where four pages of 25 are four.
Do not poll faster than the data changes. Boards are re-read on a schedule — every 15 minutes at the most frequent — so a request every ten seconds returns the same rows nine times out of ten.
Adding many boards is a queue, not a burst. Forty domains at ten a minute is four minutes. Space them out rather than firing them all and handling the 429s.

If ten a minute genuinely does not fit what you are building, tell us what you are doing — [email protected]. The number is set to keep one integration from taking the service down for everyone, not to be a wall.