Rate Limiting

The Products Manager API implements granular rate limiting to protect against abuse and ensure fair usage across all users.

Overview

Rate limiting controls how many API requests you can make within a specific time window. This protects the API from abuse, ensures fair resource allocation, and maintains system stability for all users.

Key features:

• Tiered limits: Different endpoints have different limits based on resource intensity
• Per-user tracking: Limits are tracked per authenticated user
• Clear headers: Every response includes rate limit information
• Graceful handling: 429 responses include retry timing information

Rate Limit Tiers

The API organizes rate limits into four tiers based on risk level and resource intensity:

Critical Tier

Operations that require the most restrictive limits due to security concerns or high resource cost.

High Tier

Write operations and data export functions.

Medium Tier

Standard read operations with moderate limits.

Low Tier

Public and health check endpoints with permissive limits.

Summary by Endpoint Category

Response Headers

All API responses include rate limit information in the following headers:

Example Response Headers

HTTP/1.1 200 OK
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 998
X-RateLimit-Reset: 1704067260
Content-Type: application/json

Error Handling (429 Too Many Requests)

When you exceed the rate limit, the API returns a 429 Too Many Requests response:

Response Body

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Please try again later.",
  "retry_after": "Please wait before making more requests",
  "detail": "1 per 1 minute"
}

Response Headers

HTTP/1.1 429 Too Many Requests
Retry-After: 45
X-RateLimit-Limit: 5
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1704067305
Content-Type: application/json

Environment-Based Adjustments

Rate limits vary by environment to support different use cases:

Development Environment

More permissive limits for easier testing and development:

Testing Environment

Very permissive for automated test suites:

Staging Environment

Same limits as production for realistic testing.

Production Environment

The documented limits above represent production values.

Code Examples

Python (requests)

import requests
import time

def make_api_request(url, headers, max_retries=3):
    """Make an API request with rate limit handling."""
    for attempt in range(max_retries):
        response = requests.get(url, headers=headers)

        # Log rate limit info
        remaining = response.headers.get('X-RateLimit-Remaining')
        limit = response.headers.get('X-RateLimit-Limit')
        print(f"Rate limit: {remaining}/{limit} remaining")

        if response.status_code == 429:
            # Rate limited - wait and retry
            retry_after = int(response.headers.get('Retry-After', 60))
            print(f"Rate limited. Waiting {retry_after} seconds...")
            time.sleep(retry_after)
            continue

        return response

    raise Exception("Max retries exceeded")

# Usage
headers = {"Authorization": "Bearer your-token-here"}
response = make_api_request(
    "https://api.productsmanager.app/api/v1/products",
    headers
)

JavaScript (fetch)

async function makeApiRequest(url, options = {}, maxRetries = 3) {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    const response = await fetch(url, {
      ...options,
      headers: {
        'Authorization': 'Bearer your-token-here',
        ...options.headers,
      },
    });

    // Log rate limit info
    const remaining = response.headers.get('X-RateLimit-Remaining');
    const limit = response.headers.get('X-RateLimit-Limit');
    console.log(`Rate limit: ${remaining}/${limit} remaining`);

    if (response.status === 429) {
      // Rate limited - wait and retry
      const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
      console.log(`Rate limited. Waiting ${retryAfter} seconds...`);
      await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
      continue;
    }

    return response;
  }

  throw new Error('Max retries exceeded');
}

// Usage
const response = await makeApiRequest(
  'https://api.productsmanager.app/api/v1/products'
);
const data = await response.json();

cURL

# Make a request and observe rate limit headers
curl -i -X GET \
  "https://api.productsmanager.app/api/v1/products" \
  -H "Authorization: Bearer your-token-here"

# Response will include:
# X-RateLimit-Limit: 1000
# X-RateLimit-Remaining: 999
# X-RateLimit-Reset: 1704067260

Best Practices

1. Monitor headers: Always check X-RateLimit-Remaining to avoid hitting limits
2. Implement backoff: Use exponential backoff when rate limited
3. Batch requests: Use bulk endpoints instead of multiple single requests
4. Cache responses: Reduce API calls by caching frequently accessed data
5. Use webhooks: For event-driven updates instead of polling
6. Plan for limits: Design your integration with rate limits in mind

Requesting Higher Limits

For applications requiring higher rate limits or custom quotas, please contact support with:

• Your use case description
• Expected request volumes
• Specific endpoints affected

Related Documentation

• Authentication
• API Endpoints
• Webhooks
• Security