Hillwinds API
Core Concepts

Rate Limits & Quotas

What are the API rate limits?

The API rate limits are 60 requests per minute for each live key and 10 requests per minute for each test key. Organization-level daily quotas are shared across keys; honor Retry-After whenever a request returns HTTP 429.

Per-key vs per-org scope

Rate limits and quotas apply at two scopes. Multiple keys in the same org share the daily row cap and credit pool but each get their own per-minute rate limit.

LimitScopeValue
Requests per minuteper API key60 (live) / 10 (sandbox)
Max page_sizeper request500
Sandbox max page_sizeper test-key request100
Daily rows returnedper org10,000
Credit balanceper orggrant-based

An org with three keys gets 3×60 = 180 req/min total but still only 10K rows/day.

Per-minute rate limits

Key typeLimit
Live (ss_live_*)60 requests/min per API key
Sandbox (ss_test_*)10 requests/min per API key

Daily quotas

The daily row cap is a flat anti-abuse limit across all plans. Daily query and export ceilings vary by plan — those are the levers that scale with your contract.

QuotaStarterGrowthEnterprise
Total rows returned10,000/day10,000/day10,000/day
Total queries100/day5,000/dayUnlimited
Total exports5/day50/dayUnlimited
Sandbox rows returnedShared org safety limitShared org safety limitShared org safety limit

Response headers

Every response includes rate limit and credit information. Per-key and per-org headers are labeled distinctly so clients can tell which budget is tightest.

http
X-Request-Id: req_8f3a2b1c4d5e6f7a

# Per-key (rate limit)
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1711180800

# Per-org (daily quotas + credits)
X-Org-Credits-Remaining: 48250.00
X-Org-Daily-Rows-Remaining: 8425
X-Credits-Charged: 25.00

# Conditional
X-Credits-Expiring-Soon: 3250 credits expire on 2027-07-22T00:00:00Z   (when any grant <30d from expiry)
Retry-After: 23                                                (only on 429 responses)

When you hit a limit

You'll receive a 429 response with a Retry-After header:

json
{
  "ok": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded: 60 requests per minute. Retry after 23 seconds.",
    "details": [{ "issue": "rate_limited", "limit": 60, "retry_after_seconds": 23 }],
    "request_id": "req_4e6f8a0b2c4d6e8f"
  }
}

Anti-scraping protections

ProtectionMechanismResponse
Daily row cap10,000 rows per org per day (all plans)429 DAILY_ROW_LIMIT
Crawl detectionSequential pagination through 20+ pages without filter changes429 CRAWL_DETECTED
IP diversity limit>20 unique IPs per API key per hourLogged + flagged for manual review by Hillwinds support
Response fingerprintingIdentical consecutive requests served from cacheTransparent — still counted toward rate + daily caps

Repeated IP-diversity triggers escalate to temporary key suspension; the org admin is notified to rotate the key. If you operate from a serverless platform with rotating IPs and expect to trigger this, contact support to whitelist the workload.

Cache hits still count
Cache hits don't deduct credits (you already paid), but they DO count toward the per-key rate limit, the per-org daily row cap, and crawl detection. Re-requesting the same query repeatedly is not a free path around the limits — cache responses client-side instead.
Need a key?

Keys are issued by our team, not a signup form. Book a 25-minute walkthrough and you'll leave with sandbox and live credentials.