Rate limits

Rate limiting is opt-in per endpoint rather than global. Today it applies to the AI generation endpoints, where a single account could otherwise saturate the model.

Scope	Limit
Per user, per endpoint	5 requests per minute

The limit is keyed on the user and organization decoded from your bearer token, and each AI endpoint counts separately — chat and lease drafting do not share a budget.

Being limited

{
  "statusCode": 429,
  "message": "AI rate limit exceeded. Try again in 1 minute.",
  "code": "rate_limited"
}

Back off and retry after the interval named in message. The code field is stable; match on rate_limited rather than parsing the sentence.

Everything else

Non-AI endpoints are not rate limited at the application layer. That is not a promise of unlimited throughput — infrastructure limits still apply, and heavy consumers should prefer the bulk endpoints over tight request loops:

• Bulk imports for writing many records.
• GET /api/imports/export/{resourceType} for reading a whole resource type as CSV.
• Server-sent events instead of polling for changes.