Skip to content

Rate limits

Three limits apply in this order, and a request has to pass all three.

  1. The per IP cap applies to the whole API.
  2. The wallet's own quota applies to the group the endpoint belongs to.
  3. The shared price feed budget applies to the endpoints that need live prices.

Per IP

The rate limit per IP address is set to 100 requests per second, with a burst of 200. It covers every endpoint, whether the request is signed or not, and it is checked before the per wallet buckets. Addresses behind the same NAT share the allowance.

Per wallet, per group

Each group is a token bucket, where burst is how many requests can be sent back to back and the bucket refills at per minute / 60 per second.

Group Endpoints Per minute Burst
positions GET /positions 20 5
quotes POST /order/rfq 60 10
orders POST /order 60 10
reads GET /order, GET /orders, GET /orders/updates, GET /settlements 60 10
fixtures GET /fixtures 120 20

GET /fixtures is unauthenticated, so its bucket is keyed by IP rather than wallet.

Rejected requests still count. An order refused for holding the opposite outcome spends quota the same as one that fills.

Every response from a limited endpoint carries two headers, where X-RateLimit-Limit is the size of the bucket and X-RateLimit-Remaining is what is left in it.

Shared price feed budget

Endpoints that need live prices also draw from a budget that every caller shares, and a 503 means this budget is exhausted rather than the wallet's quota. Each request costs the following.

Request Cost
GET /positions 28
POST /order/rfq 2
POST /order without an rfqId 2
POST /order carrying an rfqId 1
everything else 0

Getting more out of the quota

  • Poll GET /orders/updates with since rather than re-reading GET /orders, since it takes one call per round instead of one per page. See Orders.
  • A quote followed by an order costs 3 rather than 4, because an order carrying an rfqId pays 1.
  • Cache GET /positions instead of polling it.
  • GET /, GET /health and GET /time cost no wallet quota, but they still count against the per IP cap.