> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-action rate limits, plan quotas, the 429 response shape, and exponential backoff.

The Dacard.ai API runs three kinds of throttling. They stack. A request must clear every layer to succeed.

1. **Per-action rate limits**, short-window throttles on burst behavior. Source: `packages/core/src/rate-limit.ts`.
2. **Plan quotas**, monthly credit pools and feature gates. Source: `packages/shared/src/plans.ts`.
3. **Per-tier API call ceilings**, Business and Enterprise only.

## Per-action rate limits

| Action  | Limit       | Window     | Endpoint                                                              |
| ------- | ----------- | ---------- | --------------------------------------------------------------------- |
| `score` | 5 requests  | 60 seconds | `POST /api/score`, `POST /api/score/quick`, `POST /api/score/product` |
| `chat`  | 30 requests | 60 seconds | `POST /api/chat`                                                      |

The limit returns `429 Too Many Requests` with a `Retry-After` header. Hits are tracked per `userId` against a 60-second sliding window. The gate fails closed if the database is unreachable.

There is no per-action rate limit on `api` (API key calls). They are tracked but enforced through the per-tier monthly ceiling.

## Plan quotas

| Plan       | Monthly credits | Scores    | Chat messages | API calls/mo | Products  | Seats  |
| ---------- | --------------- | --------- | ------------- | ------------ | --------- | ------ |
| Free       | 80              | 3         | 30            | 0            | 1         | 1      |
| Pro        | 1,000           | up to 100 | up to 1,000   | 0            | 5         | 3      |
| Business   | 2,000           | up to 200 | up to 2,000   | 25,000       | 25        | 10     |
| Enterprise | Unlimited       | Unlimited | Unlimited     | 100,000      | Unlimited | Custom |

Free and Pro do not include programmatic API access. Mint API keys on Business or Enterprise from `Settings > API Keys`.

Numerics live in `packages/shared/src/plans.ts`. The source file is authoritative.

Check live consumption with [Get Usage and Quota](/api-reference/user/get-usage-and-quota).

## 429 response shape

```http theme={null}
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60

{
  "error": {
    "code": "SCORING_RATE_LIMITED",
    "message": "Too many reads in a row.",
    "action": "Give it 60 seconds and try again.",
    "retryable": true
  }
}
```

Plan-quota exhaustion returns `402` with `code: "CREDIT_EXHAUSTED"` or `code: "PLAN_LIMIT_REACHED"`. Those are not retryable. See [Errors](/api-reference/errors).

## Exponential backoff

```ts theme={null}
async function callWithBackoff<T>(fn: () => Promise<Response>): Promise<T> {
  for (let attempt = 0; attempt < 5; attempt++) {
    const res = await fn();
    if (res.ok) return res.json() as Promise<T>;

    if (res.status !== 429) {
      const body = await res.json().catch(() => ({}));
      throw new Error(body.error?.message ?? `HTTP ${res.status}`);
    }

    const retryAfter = Number(res.headers.get('Retry-After') ?? 60);
    const jitter = Math.random() * 0.25 * retryAfter;
    const delay = (retryAfter + jitter) * 1000 * Math.pow(1.5, attempt);
    await new Promise((r) => setTimeout(r, delay));
  }
  throw new Error('Exceeded max retries on 429');
}
```

Cap retries. A user staring at a spinner is a worse experience than a clear error.

## Anonymous scoring

`POST /api/score` (no session) and `POST /api/score/quick` accept anonymous reads at 1 per IP per hour. The result is held until a sign-up links it via `POST /api/score/link`.