Rate limits
Per-IP limits on public API operations, the headers that describe them, and how to handle 429 responses.
Public operations, the ones that work without authentication, are rate limited per client IP address to prevent abuse.
Limits
| Operation | Limit |
|---|---|
createSupportRequest | 5 requests per minute per IP |
subscribeToNewsletter | 5 requests per minute per IP |
unsubscribeFromNewsletter | 5 requests per minute per IP |
POST /api/careers/applications | 3 requests per minute per IP |
Limits are counted per operation over a rolling 60-second window.
Headers
Rate-limited responses include headers describing the limit (the auth-public suffix is the name of the limit):
| Header | Meaning |
|---|---|
X-RateLimit-Limit-auth-public | Requests allowed in the window |
X-RateLimit-Remaining-auth-public | Requests left in the current window |
X-RateLimit-Reset-auth-public | Seconds until the window resets |
Retry-After-auth-public | When blocked: seconds to wait before retrying |
Browsers may not expose these headers to scripts on other origins; server-side clients can always read them.
When you hit the limit
- REST endpoints respond with HTTP
429 Too Many Requestsand the standard REST error body. - GraphQL operations return an error in the
errorsarray whosemessageisThrottlerException: Too Many Requests:
Detect GraphQL rate limiting by message
For GraphQL, the error code is the generic INTERNAL_SERVER_ERROR and statusCode may not be 429. Match on a message containing Too Many Requests (or check statusCode === 429 as well, so your code keeps working if the status is reported precisely).
Best practices
Do not retry immediately
Wait for the Retry-After period (or 60 seconds if you cannot read it) before trying again.
Prevent double submits
Disable the submit button while a request is in flight. Most 429s from forms are double clicks.
Show a helpful message
Tell people to wait a minute and try again, rather than showing a generic error.
Need higher limits?
These limits apply to anonymous, public operations. If you are building an integration that needs more, contact us.