> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.finrock.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Rate Limits

> How Finrock enforces per-minute API rate limits per API key, how to read the rate limit response headers, and how to handle HTTP 429 responses.

The Finrock API enforces rate limits on a **per-minute, per-API-key** basis. Rate limits apply globally across all endpoints associated with your API key. If your application exceeds the allowed number of requests within a one-minute window, the API returns an `HTTP 429 Too Many Requests` response. The limit automatically resets at the start of the next minute.

> [!NOTE]
>
> Rate limits are enforced per API key. If you need a higher limit for a production workload, contact [support@finrock.io](mailto:support@finrock.io) to request an increase.

## Rate Limit Response Headers

Every API response includes rate limit headers so your application can proactively monitor its usage and back off before hitting the limit. Read these headers on every response:

| Header | Type | Description |
| - | - | - |
| `x-rate-limit-remaining` | integer | The number of requests remaining in the current one-minute window for this endpoint. |
| `x-ratelimit-limit` | string | The total request allowance for this endpoint and time window (e.g., `1m` denotes one minute). |
| `x-rate-limit-reset` | string | The ISO 8601 timestamp at which your rate limit window resets. |

## Example Rate Limit Header Response

The following shows what the response headers look like when you call an endpoint with the `-i` flag in cURL to inspect them:

```bash theme={null}
# Use the -i flag to print response headers
curl -i 'https://api.finrock.io/dac/v1/supported-assets'

HTTP/2 200
date: Sat, 27 Aug 2022 18:22:48 GMT
content-type: application/json; charset=utf-8
content-length: 3026
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains; preload
permissions-policy: geolocation=(self), microphone=()
referrer-policy: no-referrer
x-node-id: f1d758ba
x-rate-limit-limit: 1m
x-rate-limit-remaining: 999
x-rate-limit-reset: 2022-08-27T18:23:48.8071879Z
```

In this example, `x-rate-limit-remaining: 999` shows there are 999 requests left in the current minute window, and the limit will reset at `2022-08-27T18:23:48Z`.

## Handling a 429 Response

When your application receives an `HTTP 429`, implement a back-off and retry strategy:

1. Read the `x-rate-limit-reset` header to determine exactly when the window resets.
2. Pause requests until that timestamp is reached.
3. Resume sending requests at the start of the new window.

> [!WARNING]
>
> Do not retry a `429` response immediately in a tight loop — doing so will not succeed and will consume retries that could be used for legitimate requests. Always wait until the `x-rate-limit-reset` timestamp before resuming.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.