Skip to main content
Each account has two request budgets. A request with a valid key counts against the per-minute budget, and against the daily budget when the per-minute one admits it:
  • 60 requests per minute.
  • 10,000 requests per UTC day. The count resets at 00:00 UTC.
Both budgets belong to the account, not to a key. Every REST route, the MCP server, every API key and every connected app draws from the same two budgets.

​
Headers

Every response that reaches a route carries: The headers track only the per-minute budget. The daily count isn’t reported until you reach it. A 401, the 403 for an account with no agent access and the daily-limit 429 don’t carry them: the first two never reach a route, and the headers on the third would say requests remain.

​
Over the per-minute limit

A request past the per-minute budget gets 429 with a Retry-After: 60 header and the X-RateLimit-* headers, instead of the route’s normal response. Allocait sends the same response when it can’t read the budget, so a 429 can come without a burst on your side.
Wait for the Retry-After interval (60 seconds), then retry. To use fewer requests, check whether the endpoint has a bulk form. Several routes accept an array of up to 500 items (positions, rules, Input entries), so one request can replace many.

​
Over the daily limit

A request past the daily budget gets 429 with Retry-After set to the number of seconds until 00:00 UTC.
Requests resume at 00:00 UTC. If an agent reaches this ceiling, check it for a polling loop: read state once and reuse it. If the event you poll for is a compliance event, a webhook can send it to you (needs Read and change access).

​
Per-route caps

Two write routes also cap how many records an account can file, whatever the request budget: Past a cap, the route returns 429 with error_code: DAILY_LIMIT_EXCEEDED. The cap frees up as the oldest record in the window turns 24 hours old. This 429 carries no Retry-After: a minute doesn’t clear it, so don’t retry on a timer.

​
MCP batches

The MCP server doesn’t accept JSON-RPC batches. A request body that is a JSON array gets 400 with JSON-RPC error -32600, before it counts against either budget. Send one message per request.
  • API errors: the 429 among the other status codes.
  • Error codes: DAILY_LIMIT_EXCEEDED and the rest.
  • Webhooks: events sent to you instead of polled.