Rate Limit Overview
The API uses different rate limiting strategies depending on the endpoint and authentication status.API Endpoints
REST API endpoints (/api/*) are rate limited based on:
- Authenticated requests: 90 requests per minute per user
- Unauthenticated requests: 90 requests per minute per IP address
GraphQL Endpoint
The GraphQL endpoint (/graphql) has its own rate limit:
- Default: 90 queries per minute
- Configurable via
GRAPHQL_RATE_LIMITenvironment variable
Video Streaming
Video endpoints have a separate configurable rate limit:- Default: 90 requests per minute per IP
- Set to
-1to disable rate limiting - Configurable via
VIDEO_RATE_LIMITERenvironment variable
Rate Limit Headers
The API includes rate limit information in response headers:X-RateLimit-Limit- Maximum requests allowed in the time windowX-RateLimit-Remaining- Number of requests remaining in current windowRetry-After- Seconds until the rate limit resets (included in 429 responses)
Rate Limit Exceeded
When you exceed the rate limit, you’ll receive a429 Too Many Requests response:
Retry-After header indicating when you can retry the request.
Bypassing Rate Limits
Certain users can be granted special permissions to bypass rate limits:API Rate Limit Bypass
Users with thebypass api rate limiter permission are exempt from REST API rate limits.
GraphQL Rate Limit Bypass
Users with thebypass graphql rate limiter permission are exempt from GraphQL rate limits.
Local Development
Requests from127.0.0.1 without a forwarded IP header are not rate limited. This allows unlimited requests during local development.
From app/Providers/RouteServiceProvider.php:38-42:
Rate Limiting Implementation
The API uses Laravel’s rate limiting features with automatic Redis detection:- With Redis: Uses
ThrottleRequestsWithRedisfor distributed rate limiting - Without Redis: Uses
ThrottleRequestswith cache-based limiting
Best Practices
Monitor Rate Limit Headers
Always check theX-RateLimit-Remaining header to track your usage:
Implement Retry Logic
Respect theRetry-After header when you receive a 429 response:
Use Efficient Queries
Reduce the number of requests by:Including Related Resources
Using Field Selection
Requesting Larger Pages
Cache Responses
Implement client-side caching to reduce duplicate requests:Batch Operations
When you need multiple resources, use filtering instead of individual requests:Handling Rate Limits in Your Application
Python Example
JavaScript Example
Rate Limit Queue
For applications making many requests, implement a queue system:Rate Limit Configuration
Server administrators can configure rate limits via environment variables:Related Topics
- Pagination - Efficient data retrieval
- Filtering - Reduce requests with precise queries
- Introduction - API overview