> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Request limits and how to handle 429 responses.

Read and write limits apply to your workspace, and all of its API keys share them. The token limit
applies to each IP address that calls `POST /oauth/token`.

| Requests | Limit | Burst |
| - | - | - |
| Token: `POST /oauth/token` | 5 per minute | 10 |
| Read: `GET` requests | 50 per minute | 100 |
| Write: `POST`, `PATCH`, and `DELETE` requests | 20 per minute | 40 |

**Burst** is how many requests you can send at once before the per-minute limit applies. A batch
request counts as one request, however many records it has. To ask for higher limits, contact
support.

## When you hit a limit

You get a `429` response with the `rate_limited` code and a `Retry-After` header. Wait that many
seconds, then retry.

* Reuse your access token until it expires. Don't request a new token for each call.
* Don't retry immediately after a `429`. Repeated retries can lead to longer waits.

## Response headers

Successful responses include:

| Header | Meaning |
| - | - |
| `X-RateLimit-Limit` | Maximum requests (the burst) for this request type. |
| `X-RateLimit-Remaining` | Requests you have left. |
| `X-RateLimit-Reset` | Seconds until the limit fully resets. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.