Rate limits are enforced per API key and workspace plan.

| Plan             | Standard requests/min | Standard requests/day | Concurrent jobs |
| ---------------- | --------------------- | --------------------- | --------------- |
| Free             | 30                    | 500                   | 1               |
| Starter          | 45                    | 1,500                 | 2               |
| Growth           | 120                   | 10,000                | 3               |
| Creator (legacy) | 120                   | 10,000                | 5               |
| Agency           | 240                   | 40,000                | 5               |

When a limit is exceeded, the API returns `429 TOO_MANY_REQUESTS` and a `Retry-After` header.

Lightweight endpoints, including project reads and job-status polling, use separate counters with
50 times the standard minute and daily allowances. For Growth, that is 6,000 lightweight requests/minute
and 500,000/day. These requests do not consume the standard allowance, and standard requests do not
consume the lightweight allowance. Credit, export, and concurrent-job limits still apply.

Minute windows reset every clock minute; daily windows reset at midnight UTC.

## Response headers [#response-headers]

Responses from authenticated, rate-limited endpoints include the consolidated IETF rate-limit fields
and the existing compatibility fields. The values describe the allowance used by that endpoint.

```http title="Response Headers"
RateLimit-Policy: "minute";q=120;w=60, "day";q=10000;w=86400
RateLimit: "minute";r=119;t=42, "day";r=9999;t=42782
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1800000060
X-RateLimit-Day-Remaining: 9999
X-RateLimit-Day-Reset: 1800042782
```

`q` is the quota for the named window, `r` is the remaining request count, and `t` is the number of seconds until reset.
On a `429` response, `Retry-After` contains the seconds until the exhausted window resets.
If both windows are exhausted, it uses the later reset.