Rate limits and idempotency

Rate limits

Each key may send a number of requests per minute that depends on the plan of the person who created it: 60 on Free, 300 on Plus and 1000 on Pro. Every answer says where you stand:

RateLimit-Limit: 300
RateLimit-Remaining: 287
RateLimit-Reset: 41

Over the limit you get 429 and a Retry-After header with the seconds to wait. Many wrong keys from one address in a minute are also answered with 429. Under Developer you see the requests each key sent in the last 30 days.

Idempotency

Networks fail. If a ban request times out you do not know whether it happened. Send an Idempotency-Key header with any POST and a retry with the same key and the same body returns the first answer instead of acting twice (the answer carries Idempotent-Replayed: true).

curl -X POST …/moderation/bans \
  -H "Idempotency-Key: ban-builderman-2026-11-04" …

• Use a new key for each action: a unique ID of your own, or a UUID. 1 to 100 characters: letters, digits and _ - . :.
• Keys are remembered for 24 hours, per API key.
• The same key with a different body is an error (422), not a second action.
• Only successful answers are remembered, so after an error you can retry with the same key.