> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-application request limits and how to handle 429s.

Rate limits are enforced per `client_id` across three request classes. When you exceed a limit you
receive `429` with a `rate_limited` error and a `Retry-After` header.

## Limits

| Class | Applies to          | Sustained | Burst |
| ----- | ------------------- | --------- | ----- |
| Token | `POST /oauth/token` | 5 / min   | 10    |
| Read  | `GET /v1/**`        | 50 / min  | 100   |
| Write | `PATCH /v1/**`      | 20 / min  | 40    |

These are the v1 defaults. They may be tuned per customer.

## Response headers

Successful and throttled responses carry the standard headers:

| Header                  | Meaning                                     |
| ----------------------- | ------------------------------------------- |
| `X-RateLimit-Limit`     | The limit for the request class.            |
| `X-RateLimit-Remaining` | Requests remaining in the current window.   |
| `Retry-After`           | Seconds to wait before retrying (on `429`). |

## Handling 429

Back off for `Retry-After` seconds, then retry. Cache and reuse your access token rather than
minting a new one per request — token minting is the most tightly limited class.