Skip to main content
The Dacard.ai API runs three kinds of throttling. They stack. A request must clear every layer to succeed.
  1. Per-action rate limits, short-window throttles on burst behavior. Source: packages/core/src/rate-limit.ts.
  2. Plan quotas, monthly credit pools and feature gates. Source: packages/shared/src/plans.ts.
  3. Per-tier API call ceilings, Business and Enterprise only.

Per-action rate limits

The limit returns 429 Too Many Requests with a Retry-After header. Hits are tracked per userId against a 60-second sliding window. The gate fails closed if the database is unreachable. There is no per-action rate limit on api (API key calls). They are tracked but enforced through the per-tier monthly ceiling.

Plan quotas

Free and Pro do not include programmatic API access. Mint API keys on Business or Enterprise from Settings > API Keys. Numerics live in packages/shared/src/plans.ts. The source file is authoritative. Check live consumption with Get Usage and Quota.

429 response shape

Plan-quota exhaustion returns 402 with code: "CREDIT_EXHAUSTED" or code: "PLAN_LIMIT_REACHED". Those are not retryable. See Errors.

Exponential backoff

Cap retries. A user staring at a spinner is a worse experience than a clear error.

Anonymous scoring

POST /api/score (no session) and POST /api/score/quick accept anonymous reads at 1 per IP per hour. The result is held until a sign-up links it via POST /api/score/link.