Limits and expiry¶

These limits keep abandoned data and deliberate abuse from filling the shared database. They apply to the owner of a resource, even when an authorized service or administrator performs the request.

Bot-facing limits¶

Expired queue members and codes are removed automatically. Queue positions are normalized after expired entries are removed.

API token limits¶

An API identity can have one active token. Requests are limited per token in a fixed one-minute window:

A token's stored limit can be adjusted manually when needed. When a token exceeds its allowance, the API returns 429 Too Many Requests with Retry-After, X-RateLimit-Limit, and X-RateLimit-Remaining headers.

Storage-limit responses¶

The API returns 409 Conflict with structured details:

{
  "detail": {
    "code": "resource_limit_reached",
    "resource": "rules",
    "limit": 20
  }
}