Rate Limits & Quotas
What are the API rate limits?
The API rate limits are 60 requests per minute for each live key and 10 requests per minute for each test key. Organization-level daily quotas are shared across keys; honor Retry-After whenever a request returns HTTP 429.
Per-key vs per-org scope
Rate limits and quotas apply at two scopes. Multiple keys in the same org share the daily row cap and credit pool but each get their own per-minute rate limit.
| Limit | Scope | Value |
|---|---|---|
| Requests per minute | per API key | 60 (live) / 10 (sandbox) |
| Max page_size | per request | 500 |
| Sandbox max page_size | per test-key request | 100 |
| Daily rows returned | per org | 10,000 |
| Credit balance | per org | grant-based |
An org with three keys gets 3×60 = 180 req/min total but still only 10K rows/day.
Per-minute rate limits
| Key type | Limit |
|---|---|
| Live (ss_live_*) | 60 requests/min per API key |
| Sandbox (ss_test_*) | 10 requests/min per API key |
Daily quotas
The daily row cap is a flat anti-abuse limit across all plans. Daily query and export ceilings vary by plan — those are the levers that scale with your contract.
| Quota | Starter | Growth | Enterprise |
|---|---|---|---|
| Total rows returned | 10,000/day | 10,000/day | 10,000/day |
| Total queries | 100/day | 5,000/day | Unlimited |
| Total exports | 5/day | 50/day | Unlimited |
| Sandbox rows returned | Shared org safety limit | Shared org safety limit | Shared org safety limit |
Response headers
Every response includes rate limit and credit information. Per-key and per-org headers are labeled distinctly so clients can tell which budget is tightest.
X-Request-Id: req_8f3a2b1c4d5e6f7a
# Per-key (rate limit)
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1711180800
# Per-org (daily quotas + credits)
X-Org-Credits-Remaining: 48250.00
X-Org-Daily-Rows-Remaining: 8425
X-Credits-Charged: 25.00
# Conditional
X-Credits-Expiring-Soon: 3250 credits expire on 2027-07-22T00:00:00Z (when any grant <30d from expiry)
Retry-After: 23 (only on 429 responses)When you hit a limit
You'll receive a 429 response with a Retry-After header:
{
"ok": false,
"error": {
"code": "RATE_LIMITED",
"message": "Rate limit exceeded: 60 requests per minute. Retry after 23 seconds.",
"details": [{ "issue": "rate_limited", "limit": 60, "retry_after_seconds": 23 }],
"request_id": "req_4e6f8a0b2c4d6e8f"
}
}Anti-scraping protections
| Protection | Mechanism | Response |
|---|---|---|
| Daily row cap | 10,000 rows per org per day (all plans) | 429 DAILY_ROW_LIMIT |
| Crawl detection | Sequential pagination through 20+ pages without filter changes | 429 CRAWL_DETECTED |
| IP diversity limit | >20 unique IPs per API key per hour | Logged + flagged for manual review by Hillwinds support |
| Response fingerprinting | Identical consecutive requests served from cache | Transparent — still counted toward rate + daily caps |
Repeated IP-diversity triggers escalate to temporary key suspension; the org admin is notified to rotate the key. If you operate from a serverless platform with rotating IPs and expect to trigger this, contact support to whitelist the workload.
Keys are issued by our team, not a signup form. Book a 25-minute walkthrough and you'll leave with sandbox and live credentials.