REST

What each policy allows, how to read the headers, and what repeats cost.

Limits are per caller: by IP while you are anonymous, by account once a key or token identifies you. One agent's burst can't starve another's.

The policies

• Catalog reads — 120 requests a minute. GET /api/v1/templates, /templates/{idOrSlug}, /tags, and the open MCP tools that read them.
• Suggestions — 12 a minute. Every miss is a model call somebody pays for, so this one is deliberately tight.
• Renders — 30 a minute.
• Per key — 600 requests an hour, on top of the above.

Reading them from a response

Every rate-limited response advertises its policy, whether or not it was close to the limit:

RateLimit-Policy: "render";q=30;w=60

q is the quota, w the window in seconds. The bindings behind this return pass or fail rather than a live remaining count, so this header describes the policy — enough to pace a loop, which is what an agent actually needs.

A refusal is a 429 with Retry-After set to the window:

{ "code": "RATE_LIMITED", "message": "Too many requests. Slow down." }

Back off for Retry-After seconds. Retrying immediately just burns the next window.

Free repeats

Two caches make ordinary work cheaper than the limits suggest:

• A render is content addressed. Asking for the same template, captions, preset and watermark returns the stored file with cached: true — no encoding, no storage write.
• A suggestion is keyed by the request. The same prompt, tone and count comes back from cache without a model call.

Both still count against the request limit, so loop with intent rather than polling.