Appearance
Rate limiting
Available from v10.0.0
Rate limiting protects the API against too many calls and against guessing credentials. The limits are set in the rate limiting settings and are counted per minute.
| Name | Description |
|---|---|
| Requests per minute per member | The maximum number of calls per minute of a webservice member. A member can have its own limit on the member page. Default: 0 (no limit) |
| Requests per minute per IP without credentials | The maximum number of calls per minute of an IP address on public endpoints, without a member. Default: 0 (no limit) |
| Failed authentications per minute per IP | After this number of failed authentications in a minute, every call with credentials from that IP address gets a 429 until the minute is over. This protects the shortkeys, secrets and passwords against guessing. Default: 10 |
Per member
On the edit page of a member, Requests per minute overrides the default of the settings for that member. Leave it empty to use the default, 0 is no limit.
A member is counted by its webservice member, so all its shortkeys, its key/secret and its sessions share one limit. A member that is not added in the module (e.g. the super admin) is counted with the default limit.
Response
A call over the limit gets the HTTP status 429 and is not run:
json
{"success":false,"message":"Too many requests, try again later"}Every call with a limit has these headers:
| Header | Description |
|---|---|
X-RateLimit-Limit | The calls per minute |
X-RateLimit-Remaining | The calls left in this minute |
X-RateLimit-Reset | The Unix timestamp when the next minute starts |
Retry-After | Only on a 429: the seconds until the next minute starts |
The 429 calls are in the API logs and count as an error in the endpoint statistics.
TIP
The minute is a fixed window: the counter starts again at the start of every minute. A client that sends all its calls at the end of one minute and the start of the next can make up to twice the limit in a short time.