Skip to main content

Rate Limiting

Rate limiting of the Pigeonhole Live API is considered per API Key or OAuth User. All our API endpoints require authentication. Regardless of the authentication method, the Pigeonhole Live API allows performing requests according to the plan.

Each endpoint has two rate limiters: Burst rate limiter and daily rate limiter.

Daily Rate Limiter​

The daily rate limiter controls the maximum allowed requests in the last 24 hours. The daily limiter uses a Fixed Window Rate limiter where the 24-hour window starts with the first API call made.

The HTTP response headers will contain details for the current usage of the daily rate limiter quota according to https://www.ietf.org/archive/id/draft-ietf-httpapi-ratelimit-headers-06.htm.

Example HTTP response headers:

X-Ratelimit-Limit: 250000
X-Ratelimit-Remaining: 240000
X-Ratelimit-Reset: 86350
X-Ratelimit-Policy: 100;w=10;comment="sliding window", 250000;w=86350;comment="fixed window"
  • X-RateLimit-Limit: The maximum number of requests current API Key or OAuth User can perform per 24-hour window.
  • X-RateLimit-Remaining: The number of requests left for the 24-hour window.
  • X-RateLimit-Reset: The number of seconds until the quota associated with the expiring-limit resets.
  • X-RateLimit-Policy: The quota policies currently associated with the client. Its value is informative.

If you exceed the daily rate limit, our API will start rejecting your requests, and you'll receive an error response of HTTP 429 "Too Many Requests" with the following body:

{
  "code": 8000,
  "message": "API rate limit exceeded"
}

Burst Rate Limiter​

The burst rate limiter is applied on a short time period to prevent sudden spikes in traffic volume. The burst rate limit takes higher priority than the daily rate limit. The burst limiter uses a sliding window algorithm.

If you exceed the burst rate limit, our API will not send the rate limit headers, but it may send Retry-After: <delay-seconds> to indicate how many seconds to wait before making another request. The response body will be:

{
    "code": 1234,
    "message": "You have exceeded a burst rate limit and have been temporarily blocked. Please retry your request again later."
}