Rate limits & quotas

Two independent mechanisms protect the platform: short-window rate limits on requests, and monthly scan quotas per workspace plan.

Rate limits

Requests are limited per API key (per IP when anonymous) over a sliding window. When you exceed a limit the API responds 429 Too Many Requests with a Retry-After header (seconds). Back off and retry after that delay.

Your effective per-minute limit is visible at any time via GET /api/usage (rateLimitPerMinute).

Scan quotas

Each workspace plan includes a monthly scan quota. Two things are worth knowing:

• Cache hits are free. Submitting a recently-scanned URL returns the completed result instantly and does not consume quota.
• Quota state is live on GET /api/usage: scansThisMonth, monthlyScanQuota, scansToday.

curl https://api.urlyze.io/api/usage -H "X-Api-Key: YOUR_API_KEY"

{
  "tier": "Pro",
  "scansThisMonth": 412,
  "monthlyScanQuota": 5000,
  "rateLimitPerMinute": 60,
  ...
}

Being a good citizen

• Poll scan results every 3–5 seconds, not in a tight loop.
• Honor Retry-After on every 429.
• Do not re-submit with bReAnalyze unless you specifically need a fresh scan — the cache answer is the same scan, minutes younger.