Understanding API Rate Limits

What are Rate Limits?

Rate limiting is a strategy used to control the amount of incoming traffic to a network. By restricting the number of requests a user or IP address can make to an API within a given timeframe, we ensure that the platform remains stable, responsive, and secure against Denial of Service (DoS) attacks.

IARAP API Limits

If you are integrating with the IARAP public API, please adhere to the following limits:

• Unauthenticated requests (Public Tier): 60 requests per minute per IP address.
• Authenticated requests (Developer Tier): 300 requests per minute per API Key.
• Enterprise Tier: Custom limits defined in your SLA.

Identifying a Rate Limit Error

When you exceed your allowed quota, the IARAP API will reject subsequent requests and return an HTTP status code:

HTTP 429 Too Many Requests

The response headers will also include vital information:

• X-RateLimit-Limit: Your total allowed requests in the current window.
• X-RateLimit-Remaining: How many requests you have left.
• X-RateLimit-Reset: A Unix timestamp indicating when your limit will reset.

Best Practices for Handling 429s

1. Implement Exponential Backoff: Do not immediately retry a failed request. Instead, wait for a short period (e.g., 1 second) before retrying. If it fails again, double the wait time (2 seconds, then 4, etc.).
2. Respect the Reset Header: Read the X-RateLimit-Reset header and pause your application's requests until that exact timestamp is reached.
3. Caching: If you are requesting data that doesn't change frequently (like category lists), cache the response locally in Redis or memory instead of hitting the API on every page load.