Rate Limits

Each principal (API key holder) is limited by a per-process token bucket.

Default

60 requests per minute per principal (capacity 60, refill 1 token/second).

Response when limited

HTTP 429
{ "ok": false, "error": { "code": "RATE_LIMITED", "message": "..." } }

Scope of this guarantee

This is a per-process limiter, not a distributed one — accurate for a current single-instance deployment. It is not yet a claim of production-grade multi-instance abuse protection; that is a known, explicit limitation rather than an unstated gap.