429 rate_limit_exceeded with a Retry-After header telling you when to try again.
Limits per tier
Rate limits scale with your tier. The limit is expressed per second but enforced over a sliding ~10-second window — so the actual budget israte × window requests in any 10-second span (e.g. DEVELOPER = 5/s × 10s = 50 requests per window).
If you have multiple keys, each gets its own per-tier budget.
Higher limits (up to 100 req/sec) are available for enterprise contracts. Email support@acrelens.com.
Response headers
Every response — success or failure — includes:
When you exceed the limit, the response also includes:
429 response shape
retriable: false. This is intentional — the error itself isn’t transient, it’s telling you to slow down. Treat it as retriable in your client logic, but always wait the Retry-After interval first.
Handling 429 correctly
The right pattern is respect Retry-After, then exponential backoff if you keep hitting it:
- Retrying immediately.
Retry-After: 2means wait at least 2 seconds. Hammering the endpoint just keeps you locked out. - Ignoring
X-RateLimit-Remaining. If you read1from a recent response, slow down before the 429 — back off pre-emptively. - Not jittering. If multiple workers all retry at exactly
now + Retry-After, you’ll thunder back into the limit.
Polling vs. webhooks
If you’re hitting429s while polling for report completion, switch to webhooks. One webhook delivery costs zero rate-limit budget; a polling loop checking every 5 seconds for 90 seconds spends ~18 requests. With concurrent reports it adds up fast.
Quota vs. rate limits
These are different limits with different errors:
See the errors reference for the full catalog.
Health checks
GET /v1/health is unauthenticated and not rate-limited — safe to use for liveness probes.