For AI agents: the complete documentation index is at https://docs.routebase.dev/llms.txt. Every page is also available as Markdown by appending index.md to its URL or by sending Accept: text/markdown.
API Policies

Rate Limits

The Routebase API limits how many requests a client can send in a time window. This page lists the limits and explains how to handle a rejected request.

The same values are available as a machine-readable file at governance/rate-limits.yaml.

Limits

Budget Requests Window Counted per
Authenticated requests 5,000 60 seconds User
Requests without a user 100 60 seconds IP address
MCP endpoint 200 60 seconds User

These limits are the same on every plan.

How requests are counted

Each window is a sliding window, so it moves with every request instead of resetting at a fixed time.

API keys share the budget of their user. Creating a second key for the same user does not add requests, because both keys count against one budget.

SCIM requests count as requests without a user. A SCIM token identifies an organization and not a user, so these requests use the budget of the IP address they come from. Your identity provider and anything else behind the same address share those 100 requests.

The MCP endpoint has its own budget. MCP Authentication explains how that budget applies to agents.

When you exceed a limit

The API rejects the request instead of queueing it. The response has these properties:

  • The status is HTTP 429.
  • The Retry-After header holds the number of seconds to wait.
  • The body is JSON in the problem details format, and its retryAfter field holds the same number.
{
  "type": "https://httpstatuses.io/429",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "Rate limit exceeded. Please try again later.",
  "instance": "/api/projects",
  "traceId": "0HNPRV4VQP40T:0000000D",
  "retryAfter": 12
}

Handling HTTP 429

  1. Read Retry-After from the response.
  2. Wait at least that many seconds before you send the request again.
  3. Add a small random delay when several workers share a budget, so they don't all retry at the same moment.

Reading your remaining budget

Responses from the REST API and from SCIM carry two headers that show your budget before you reach the limit. They follow the IETF draft draft-ietf-httpapi-ratelimit-headers:

RateLimit-Policy: "authenticated";q=5000;w=60
RateLimit: "authenticated";r=4873
  • RateLimit-Policy names the budget, with its quota in q and its window in seconds in w.
  • RateLimit holds the requests you have left in r. On a 429 response it also holds t, which is the same number of seconds as Retry-After.

A response can arrive without these headers, so treat a missing header as an unknown budget and not as an exhausted one. The MCP endpoint doesn't send them.