Rate Limits

Remy applies the following default limits to the public API:

Scope	Limit
All authenticated requests	120 requests per minute per API key
All authenticated requests	10,000 requests per day per API key
Order creation	60 requests per minute per API key
Voucher redemption	60 requests per minute per API key
Voucher PDF generation	10 requests per minute per API key
Failed authentication	10 failures per 5 minutes per IP address
Concurrent requests	10 active requests per API key

Endpoint-specific limits are applied in addition to the overall minute and daily limits. These defaults may be reduced temporarily to protect service availability.

Rate-limit responses

When a limit is exceeded, the API returns HTTP 429:

{
  "code": 429,
  "message": "Public API rate limit exceeded",
  "retryAfter": 42
}

Responses include standard rate-limit headers where applicable:

RateLimit-Limit: 120
RateLimit-Remaining: 0
RateLimit-Reset: 42
Retry-After: 42

Counters are associated with a one-way hash of the API key; the key itself is not retained by the limiter.

Clients should:

• Avoid unnecessary polling and cache safe read results where appropriate.
• Process list endpoints page by page instead of requesting large bursts.
• Treat HTTP 429 as retryable after the stated delay.
• Use exponential backoff with jitter for 429 and transient 5xx responses.
• Honour Retry-After when the response includes it.

Do not automatically retry validation, authentication, or not-found errors.