we-fly applies sliding-window rate limits at three levels.
Per endpoint type
| Endpoint | Limit (req/min) | Notes |
|---|---|---|
POST /api/oauth/token | 30 | Strict — protects against brute-forcing client_secret |
POST /api/oauth/revoke | 30 | Same bucket as /token |
POST /api/oauth/introspect | 30 | Same bucket |
GET /api/v1/* | 120 (per principal, fallback tier) | See Application tiers for OAuth apps |
POST /api/v1/flights/upload | Shared with other v1 endpoints | Single-upload throughput is fine; bulk imports should pace at ~1/sec |
Application tiers
OAuth applications get an additional per-application quota that caps aggregate traffic across all users:
| Tier | Limit (req/min) |
|---|---|
standard (default) | 600 |
premium | 3,000 |
unlimited | 60,000 (functionally uncapped) |
New apps land on standard. Contact an admin if you need higher
volume; we'll review your use case and grant a tier increase.
Headers
Successful responses (and 429 responses) carry:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Current window's maximum |
X-RateLimit-Remaining | How many you have left in the window |
X-RateLimit-Reset | Unix epoch (ms) when the window resets |
On 429:
| Header | Meaning |
|---|---|
Retry-After | Seconds to wait. Honour this. |
Implementation guidance
- Use a token bucket (or any work-rate limiter) on your side so you never hit 429 in the first place.
- On 429, back off for
Retry-Afterseconds. Random jitter (±10%) helps if multiple workers hit at the same time. - On 5xx, retry with exponential backoff starting at 1 second; cap at 4 retries.
- Do not retry on 4xx (other than 429) — the request is malformed; retrying won't fix it.
What gets your app suspended
- Sustained
Retry-Afterviolations (you keep hammering despite 429s). - A persistently high
invalid_grantrate — usually a logic bug in your refresh handling (see refresh-token rotation). - Traffic patterns consistent with credential abuse or using the app as an open relay.
Admins review per-app counters and error rate — see usage telemetry for what's measured. Suspensions are reversible — fix the issue, ping us, we'll un-suspend.