Rate Limits
API usage limits and quotas
Understand rate limits for each plan and learn best practices for efficient API usage. Monitor your usage with rate limit headers in every response.
0
Free/Month
0K
Pro/Month
Custom
Enterprise
Key Features
Everything you need to protect your infrastructure and users
Per-Minute Limits
Burst limits to ensure fair usage and system stability.
Monthly Quotas
Total request allowance that resets monthly.
Rate Headers
Track limits with X-RateLimit-* response headers.
Usage Dashboard
Monitor your usage in real-time from the dashboard.
429 Handling
Graceful error handling with retry-after guidance.
Custom Limits
Enterprise customers can request custom limits.
Use Cases
How security teams use this tool
Usage Monitoring
Track remaining quota to avoid unexpected limits.
Request Batching
Use bulk API to maximize efficiency.
Caching Strategy
Cache responses to reduce API calls.
Plan Selection
Choose the right plan for your volume.
Understanding API Rate Limits
Rate limits protect our infrastructure and ensure fair access for all users. We implement both per-minute burst limits and monthly quotas. Burst limits prevent any single user from overwhelming the system during peak usage, while monthly quotas align with subscription tiers. Understanding these limits helps you architect your integration for reliable operation under all conditions.
Monitoring Your API Usage
Every API response includes X-RateLimit headers showing your current limits, remaining requests, and reset timestamps. The X-RateLimit-Limit header shows your quota, X-RateLimit-Remaining shows how many requests you have left, and X-RateLimit-Reset indicates when your quota resets (as a Unix timestamp). Your dashboard provides historical usage graphs and alerts when approaching limits.
Handling Rate Limit Errors
When you exceed limits, the API returns a 429 Too Many Requests status code with a Retry-After header indicating when you can resume. Our SDKs handle this automatically with exponential backoff and configurable retry policies. For applications without SDK support, implement your own retry logic: wait for the Retry-After period, then resume with backoff to avoid hammering the API.
Tuning API Consumption
Reduce API calls by caching responses for frequently-queried entities, using bulk endpoints instead of multiple single lookups, and requesting only the data fields you need. Consider implementing local blocklists for known-malicious indicators to avoid redundant API calls. Enterprise customers can request custom rate limits tailored to their specific workload patterns.
Frequently Asked Questions
What are the rate limits per plan?
How do I know my current usage?
What happens if I exceed the limit?
Can I request a rate limit increase?
Related Tools
Related Articles
Learn more from our security research blog
Ready to Get Started?
Rejoignez des milliers d'équipes de sécurité qui utilisent isMalicious pour protéger leur infrastructure.