---
title: Rate Limits
description: Understand shared member rate limits, read response headers, throttle before a 429 response, and inspect current REST capacity.
---

REST request capacity is shared by the member. Every user, account, and API key under that member uses the same `read`, `write`, and `cancel` buckets. Creating another API key does not increase the available capacity.

These limits apply only to authenticated REST operations. Public REST operations and WebSocket traffic use separate limits.

## Handle a `429` Response

When a REST request exhausts its bucket, UDX returns:

- `429 Too Many Requests`;
- `Retry-After` in integer seconds;
- `Cache-Control: no-store`; and
- Problem Details with `type: urn:udx:problem:member-rate-limit-exceeded`.

Wait for at least the `Retry-After` interval, then retry with a new timestamp and signature. If the mutation used an idempotency key, reuse the same `UDX-Idempotency-Key`. A request rejected by a rate limit is not saved as the operation's result.

A `503 Service Unavailable` means UDX could not safely evaluate whether to admit the request; it does not mean the member exhausted its capacity. Retry `503` responses with bounded exponential backoff and jitter. Do not use the human-readable `detail` field to decide how to recover.

## Throttle Before a `429`

Responses for requests that use a REST bucket include `RateLimit-Policy` and `RateLimit` headers for that bucket:

```http
RateLimit-Policy: "read";q=30;w=2
RateLimit: "read";r=12;t=1
```

- `q` is the bucket's token capacity.
- `w` is the number of seconds required to refill an empty bucket.
- `r` is the number of tokens remaining after the request.
- `t` is the number of seconds until the bucket is full.

Use `r` to slow requests before receiving a `429`. These headers are absent when a request does not use a REST bucket, including an idempotent replay and a `503`.

The field format follows the IETF's [RateLimit header fields for HTTP draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/). HTTP `429 Too Many Requests` and `Retry-After` behavior are defined in [RFC 6585](https://www.rfc-editor.org/rfc/rfc6585.html#section-4).

## Check Current Limits

[`GET /rate_limit_profile`](/api-reference/rate-limits/getratelimitprofile) returns the member's bucket capacity, refill rate, and cost per request. This request uses the `read` bucket.