> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allocait.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Request budgets, headers and the 429 response.

Each account has two request budgets. A request with a valid key counts against the per-minute budget, and against the daily budget when the per-minute one admits it:

* **60 requests per minute.**
* **10,000 requests per UTC day.** The count resets at 00:00 UTC.

Both budgets belong to the account, not to a key. Every REST route, the MCP server, every API key and every connected app draws from the same two budgets.

## Headers

Every response that reaches a route carries:

| Header | Meaning |
| - | - |
| `X-RateLimit-Limit` | Always `60`, the per-minute budget. |
| `X-RateLimit-Remaining` | Requests left in the rolling 60-second window. It shows the full budget if Allocait can't read the count. |

The headers track only the per-minute budget. The daily count isn't reported until you reach it. A `401`, the `403` for an account with no agent access and the daily-limit `429` don't carry them: the first two never reach a route, and the headers on the third would say requests remain.

## Over the per-minute limit

A request past the per-minute budget gets `429` with a `Retry-After: 60` header and the `X-RateLimit-*` headers, instead of the route's normal response. Allocait sends the same response when it can't read the budget, so a `429` can come without a burst on your side.

```json theme={null}
{
  "error": "Rate limit exceeded. Maximum 60 requests per minute."
}
```

Wait for the `Retry-After` interval (60 seconds), then retry. To use fewer requests, check whether the endpoint has a bulk form. Several routes accept an array of up to 500 items (positions, rules, Input entries), so one request can replace many.

## Over the daily limit

A request past the daily budget gets `429` with `Retry-After` set to the number of seconds until 00:00 UTC.

```json theme={null}
{
  "error": "Daily limit exceeded. Maximum 10,000 requests per UTC day."
}
```

Requests resume at 00:00 UTC. If an agent reaches this ceiling, check it for a polling loop: read state once and reuse it. If the event you poll for is a compliance event, a [webhook](https://docs.allocait.app/guides/webhooks.md) can send it to you (needs **Read and change** access).

## Per-route caps

Two write routes also cap how many records an account can file, whatever the request budget:

| Route | Cap |
| - | - |
| `POST /support-requests` | 20 per rolling 24 hours by default, including requests filed in the app |
| `POST /agent-feedback` | 20 per rolling 24 hours by default, including feedback filed over MCP. A repeat of a report that is still open adds to the first and doesn't count |

Past a cap, the route returns `429` with `error_code: DAILY_LIMIT_EXCEEDED`. The cap frees up as the oldest record in the window turns 24 hours old. This `429` carries no `Retry-After`: a minute doesn't clear it, so don't retry on a timer.

## MCP batches

The MCP server doesn't accept JSON-RPC batches. A request body that is a JSON array gets `400` with JSON-RPC error `-32600`, before it counts against either budget. Send one message per request.

## Related

* [API errors](https://docs.allocait.app/api/errors.md): the `429` among the other status codes.
* [Error codes](https://docs.allocait.app/api/error-codes.md): `DAILY_LIMIT_EXCEEDED` and the rest.
* [Webhooks](https://docs.allocait.app/guides/webhooks.md): events sent to you instead of polled.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.