---
title: "Limits are per key, per minute, by class"
description: "The per-class limits and the Retry-After contract."
canonical: "https://writavo.com/docs/rate-limits"
last-updated: "2026-08-07"
---

# Limits are per key, per minute, by class

Writes are limited harder than reads, and pipeline runs hardest because they cost real money.

## The classes

| Class | Applies to | Limit |
|---|---|---|
| read | every GET | 600 per minute |
| write | POST, PATCH and DELETE on content, taxonomy, keys, webhooks, the content plan, formats and prompts, settings, delivery, SEO curation, the team and billing | 120 per minute |
| upload | `POST /media/upload-url` and `POST /seo/backlinks/import` | 60 per minute |
| pipeline | `POST /pipeline/runs`, `POST /pipeline/articles/{id}/requeue`, `POST /delivery/cms/push` and the seven paid SEO scans | 10 per minute |
| auth | `POST /auth/device` and `POST /auth/device/token`, per IP address | 60 per minute |

Every operation in the [reference](/docs/api) states its class.

## The headers

on every response:

```
RateLimit-Limit: 600
RateLimit-Remaining: 587
RateLimit-Reset: 1786000860
```

- `RateLimit-Limit`: what your key may send in the current window for this endpoint class.
- `RateLimit-Remaining`: what is left.
- `RateLimit-Reset`: the Unix second the window resets.
- `Retry-After` (seconds) is on every 429. Honour it.

## When you are limited

`RATE_LIMIT_EXCEEDED`. Back off and honour `Retry-After`.

Limits are per key, per minute, by endpoint class. The two device sign-in endpoints take no key,
so they are limited per IP address.

| Class | Endpoints | Limit |
|---|---|---|
| read | every GET | 600 per minute |
| write | POST, PATCH and DELETE on content, taxonomy, keys, webhooks, the content plan, formats and prompts, settings, delivery, SEO curation, the team and billing | 120 per minute |
| upload | `POST /media/upload-url` and `POST /seo/backlinks/import` | 60 per minute |
| pipeline | `POST /pipeline/runs`, `POST /pipeline/articles/{id}/requeue`, `POST /delivery/cms/push` and the seven paid SEO scans | 10 per minute |
| auth | `POST /auth/device` and `POST /auth/device/token`, per IP address | 60 per minute |

`POST /comments` adds three limits, named in `error.limit` on its 429: `reader` (5 per reader in
10 minutes, by `reader_ip`), `site` (300 per Site per hour) and `queue` (2,000 awaiting review).

Every response carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`.

> The window slides, so aligning a burst to the top of a minute gains nothing. A steady rate beats a spike followed by a wait.

- **Back off exponentially** from `Retry-After`, with jitter, so your workers do not all retry at once.
- **Batch reads with `limit` and `fields`.** One request for 100 projected rows costs one unit; 100 requests cost 100.
- **Do not poll `GET /pipeline/runs` in a tight loop.** Subscribe to `pipeline.run.completed`.
- **A 429 is not a spend gate.** Runaway cost is stopped by the 402 family on the [errors page](/docs/errors#the-three-402s).

## Higher limits

Some plans raise the ceiling for every key on the Site, with no code change. The first request of a session runs at the standard rate; the higher rate applies from the next.

Hitting a limit with a legitimate workload? Contact [support](https://writavo.com/support).