# Rate limits

## The limits

| Caller | Requests per minute | Counted per |
| --- | --- | --- |
| API key, on the REST API or the MCP server | 120 | Key |
| No key, on the REST API | 60 | IP address |
| AI assistant connected by signing in, on the MCP server | 100 | Person |

If you need more than 120 requests a minute, write to
[info@fentlig.se](mailto:info@fentlig.se).

## Headers

Every REST API response carries these headers:

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | Requests allowed per minute |
| `X-RateLimit-Remaining` | Requests left in the current minute |
| `X-RateLimit-Reset` | When the current minute ends, as a Unix timestamp |

A 429 response also carries `Retry-After`, in seconds.

## Handling a 429

A 429 means you sent too many requests; your key is fine. The body is a
problem document:

```json
{
  "type": "https://fentlig.se/developers/errors/rate-limit-exceeded",
  "title": "Too many requests",
  "status": 429,
  "detail": "This key has used the requests its window allows. Wait the number of seconds in the Retry-After header, then send the request again. The key itself is fine and does not need replacing.",
  "instance": "/v1/notices",
  "code": "RATE_LIMIT_EXCEEDED"
}
```

Wait `Retry-After` seconds, then continue with the same key.

If you reach the limit often, narrow the query with `status`, `region` or
`cpv` instead of retrying.

## On the MCP server

A key over its budget on the MCP server gets the same problem document as on
the REST API.

An assistant connected by signing in gets HTTP 429 with `Retry-After` and a
JSON-RPC error:

```json
{
  "jsonrpc": "2.0",
  "id": null,
  "error": { "code": -32000, "message": "Too many requests. Retry shortly." }
}
```

## User-Agent

Send a `User-Agent` that names your application and gives a contact
address.