Skip to main content

Rate limits

To keep the platform healthy, the API throttles abusive or runaway traffic. Sensitive flows — login attempts in particular — are rate limited per account and per IP.

When you're throttled, the response is 429 Too Many Requests:

{
  "code": "RATE_LIMITED",
  "message": "Too many requests. Please wait before trying again.",
  "retry_after": 30
}
retry_afterinteger

Seconds to wait before retrying.

Backing off​

  • Honor retry_after exactly — don't retry sooner.
  • If retry_after is absent, use exponential backoff with jitter (e.g. 2s, 4s, 8s… ±20%).
  • Treat repeated 429s on login as a signal to stop: hammering the endpoint extends the lockout and can trip account protection.

Batch-style workloads should spread requests out rather than bursting. If you have a legitimate high-volume use case, talk to us at letstalk@getroja.com.