RFC 014 — Public API Rate Limiting
💬
1 · Summary
We are introducing rate limiting to the public API to protect shared infrastructure and ensure fair usage across customers. This document proposes the limiting strategy, the per-tier limits, and the rollout plan.
💬
2 · Limiting strategy
💬 1 open · Concern
Requests are counted and limited per client IP address. When a client exceeds its window, the API returns 429 Too Many Requests with a Retry-After header.
💬
2.1 · Per-tier limits
| Tier | Counted per | Requests / min |
|---|---|---|
| Free | IP | 60 |
| Pro | IP | 600 |
| Enterprise | IP | Custom |
💬
2.2 · Enforcement flow
🖼️ Architecture diagram · image blocks resolve to a manual replace, not an AI redraw
💬
3 · Rollout
Limits will be enabled in shadow mode for two weeks, logging would-be rejections without enforcing them. We then enforce for Free tier first, followed by Pro and Enterprise.
💬
4 · Open questions
How should we handle burst traffic for webhook retries? Should Enterprise customers be able to self-configure their own ceilings?
⚠ edited after decision — thread #38 was resolved, then this block was hand-edited