# Rate limits and quotas

> 120 requests per minute per key, your plan's quotas for each period, and the few ceilings that protect Rustine and the scanned sites.

## Rate: 120 requests per minute per key

Every response says so in its headers: `X-RateLimit-Limit` (the ceiling), `X-RateLimit-Remaining` (what is left this minute) and `X-RateLimit-Reset` (when the window restarts, in Unix seconds). Past that, the API answers `429 rate_limited` with `Retry-After`: wait that long and carry on. The MCP server follows the same limit.

To follow a scan, one request every 3 to 5 seconds is plenty.

## Your plan's quotas

Your plan gives you quick scans, full audits and fixes **per project**, over a 30-day period; each extra project adds its share. Once the period's quota is used up, Rustine takes from your pack credits if you have any. Otherwise the action answers `402` (`scan_quota_exceeded`, `audit_quota_exceeded` or `fix_quota_exceeded`) with `upgrade_url`. [Your plan and quotas](https://docs.rustine.io/en/api/account.md) tells you where you stand.

What costs nothing:

- reading your projects, scans and issues;
- reading a fix you already unlocked;
- scanning the same site with the same kind again within the hour: Rustine returns the recent result (`reused: true`) without charging anything;
- analysing a GitHub repository;
- rechecking an issue, up to 60 rechecks per project and per day.

## Rustine's ceilings

A few ceilings protect the platform and the scanned sites. You should not meet them, but your code should know what to do:

- **Too many scans at once on Rustine**, or the platform's daily ceiling reached: a new scan gets `503 platform_busy`. Retry in a few minutes; nothing was charged.
- **Rechecks**: 60 per project and per day, then `429 recheck_limit_reached`.
- **Repository analyses**: a limited number per workspace over 24 hours, pushes included, then `429 repository_analyses_limit_reached`. A recheck on a repository starts at most one analysis per quarter of an hour.

These ceilings may be tightened in case of abuse, without notice: always treat `429` and `503` as "retry later".

| Plan | Projects included | Quick scans | Full audits | Fixes | Addresses per project | API and MCP |
| --- | --- | --- | --- | --- | --- | --- |
| Free | 1 | 10 | 0 | 3 given once | 1 | no |
| Solo | 1 | 30 | 60 | 15 | 5 | 14-day trial |
| Pro | 3 | 100 | 60 | 30 | 20 | included |

Quick scans, full audits, fixes: per project and per month.

## Examples

### curl

```bash
curl -i https://api.rustine.io/v1/projects \
  -H "Authorization: Bearer $RUSTINE_API_KEY"
```

### Response: 429 Too Many Requests

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1792061520

{
  "error": {
    "type": "rate_limited",
    "code": "rate_limited",
    "message": "Too many requests for this key (120 per minute).",
    "doc_url": "https://docs.rustine.io/api/errors#rate_limited"
  }
}
```