Per-organization buckets
Rate limits are enforced per organization, not per key. Every key issued to the same organization shares one bucket, and calls made through the MCP server draw from that same bucket, so adding keys or clients doesn’t multiply your quota.
The window is sliding: a request made 24 hours ago frees its slot.
Quota in response headers
Rate-limit state comes back as HTTP headers on every response (not in the body):When you exceed the limit
Over-quota requests return429 with a rate_limit_error envelope and a
Retry-After header (seconds):
Retry-After elapses (or X-RateLimit-Reset), then retry.
Over MCP, the tool call returns an error message instead of a result.
The limiter fails open: if the rate-limit backend is briefly
unavailable, requests are allowed through and no
X-RateLimit-* headers are
emitted. Don’t depend on the headers always being present.Staying well under the limit
- Use
page_size=100when paging; fewer, larger pages cost fewer requests. - For a complete copy of the data, one export replaces hundreds of list calls.
- For aggregates, call
GET /v1/analyticsonce rather than paging rows to count them. - Sync incrementally with
sinceon the actuaciones feed (see Pagination & filters) instead of re-reading the portfolio.
Next: Errors
The error envelope and every error code.