The API sits behind a CDN cache, and rate limits are only applied to requests that miss it, so a cached response is free.
How a request is counted#↑
- The CDN gets your request first. If it holds a fresh copy of the response, it answers right away. That request never reaches our servers and is not counted.
- On a miss, our server counts the request against your limit, then answers.
The cf-cache-status response header tells you which happened: HIT was served from cache.
So requesting GET /v2/series/1 ten times in a row usually counts once: the first request fills the cache and the rest are hits until the cached copy expires.
Limits#↑
| Kind | Applies to | Limit | Burst |
|---|---|---|---|
| Search | GET /v1/series/search, GET /v2/series/search |
30 requests per minute | 5 |
| Default | Everything else, including /my |
180 requests per minute | 5 |
- Limits are per client IP. IPv6 clients share one limit per /64 prefix.
- Requests of the same kind share one budget:
GET /v2/series/1andGET /v2/series/2both draw from Default. - Burst is how many requests over the rate get through at once before limiting starts.
- Data dumps and the RSS feeds are not rate limited.
- MCP tool calls are never served from cache, so every call counts. Most draw from the Search and Default budgets above, and the MCP page lists the limit for each tool.
- Moderator endpoints under
/modhave their own, higher limit.
When you hit the limit#↑
You get 429 Too Many Requests with a Retry-After: 10 header and this body:
{
"status": 429,
"message": "Too Many Requests"
}
Wait for Retry-After seconds, then retry.
What gets cached#↑
- Only successful
200responses. A404,400or500is never cached, so repeating a failing request counts every time. - Only
GETrequests that need no authentication. Anything under/my, and any write, is never cached. - How long each endpoint is cached is stated in its description in the API reference. The CDN may serve a copy up to 60 seconds past expiry while it fetches a fresh one, and your browser keeps a response for at most 60 seconds.
Staying under the limit#↑
- Reuse the same URLs. A different parameter value is a different cache entry, and a miss. Parameter order doesn't matter:
?a=1&b=2and?b=2&a=1share one entry. - Don't add cache-busting parameters. Many endpoints reject unknown parameters, see Errors.
- For the whole catalog, download the data dumps instead of crawling the API.