What counts
Every authenticated request counts once, including a Redis cache hit and an application-level error produced after authentication. Authentication failures do not consume an account quota because no account can be identified.
Provider refresh traffic is internal ingestion work and is never billed to a customer.
Response headers
| Header | Meaning |
|---|---|
| X-RateLimit-Limit | Maximum requests in the current minute. |
| X-RateLimit-Remaining | Requests left in that minute. |
| X-Quota-Limit | Maximum requests in the current billing period. |
| X-Quota-Remaining | Requests left in the billing period. |
| X-Quota-Reset | UTC time when the billing-period counter resets. |
| X-StatsAPI-Cache | HIT or MISS for the versioned response cache. |
Handle HTTP 429
Stop sending requests when a 429 response arrives. Retry after the next minute boundary for a rate-limit error; a depleted monthly quota requires the billing period to reset or the account plan to change.
Use exponential backoff with jitter for unexpected bursts and cache stable responses in your own application when appropriate.