Rate limits
The public API enforces per-minute quotas on every route. Limits aim to stay generous for normal integration patterns while isolating one noisy integration from others.
Default limits
Section titled “Default limits”| Tier | Per minute | Applies to |
|---|---|---|
| Read | 120 | GET / HEAD under /api/v1/… |
| Write | 30 | Other HTTP methods under /api/v1/… |
| Auth | 20 | POST /api/auth/token only (token exchange) |
Limits may differ by environment. Contact your Aware account team if you need higher quotas.
Headers (when rate limiting applies)
Section titled “Headers (when rate limiting applies)”We emit RateLimit-* headers on responses:
| Header | Meaning |
|---|---|
RateLimit-Limit | Allowed requests in the current window for this class. |
RateLimit-Remaining | Requests remaining in the window. |
RateLimit-Reset | Seconds until the window resets. |
Retry-After | On 429 only — seconds to wait before retry. |
When you exceed a limit
Section titled “When you exceed a limit”You get 429 RateLimited:
{ "type": "RateLimited", "message": "Rate limit exceeded. Retry after 23 seconds."}Recommended client behaviour
Section titled “Recommended client behaviour”- Honour
Retry-Afteron429. - Add jitter on bulk retries so clients don’t resync their spikes.
Reads vs writes vs token calls
Section titled “Reads vs writes vs token calls”Separate counters apply: reads do not consume the write bucket, and token requests do not consume the versioned read/write buckets. Limits on /api/v1/… are attributed per integration (your token), not only by source IP.
Need a higher limit?
Section titled “Need a higher limit?”Contact your Aware account team with the expected traffic shape.