Usage Limits

Reloop enforces rate limits on API requests to ensure stability and fair usage across all organizations. Limits are tracked with fixed-window counters backed by Redis.

If a limit is exceeded, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait.

Baseline Limit

Every API endpoint shares a baseline of 600 requests per 60 seconds per client. A client is identified by its API key, then its dashboard session, then its IP address for unauthenticated requests. The budget is shared across all services, so calls to /api/domain, /api/contacts and /api/logs draw from the same bucket.

The endpoint-specific limits below apply on top of the baseline, and the stricter one wins. Self-hosted deployments can change the baseline with the API_RATE_LIMIT_MAX and API_RATE_LIMIT_WINDOW_SECONDS environment variables.

Management Endpoint Limits

Management endpoints cover everything outside of email sending: domains, contacts, channels, groups, properties, API keys, and templates. Each endpoint category has its own independent limit.

Domain Service

Contacts Service

Channels Service

Groups Service

Contact Properties Service

API Keys Service

Preferences Service

---

Email Sending Limits

The email sending endpoint (/api/mail/v1/send) uses a multi-layer rate limiting strategy. All five layers are checked in parallel. If any single layer is exceeded, the request is rejected. The organization daily layer applies only to plans with a daily sending limit (Free); Pay as you go, Pro and higher plans have no daily cap.

When a sending request is rate limited, the error response tells you which layer was exceeded:

{
  "message": "Too Many Requests",
  "why": "Rate limit exceeded on the organization layer. You have sent too many requests in the current time window.",
  "fix": "Please wait 42 seconds before retrying, or contact support to increase your limits."
}

---

Rate Limit Headers

Every API response, including errors such as 401 and 404, includes rate limit headers. When an endpoint has its own stricter limit, the headers describe that limit.

X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset carry the same values for older clients. Email sending responses also include x-reloop-daily-quota and x-reloop-monthly-quota with your used send counts.

---

Best Practices

• Monitor headers proactively. Check ratelimit-remaining before it reaches zero to avoid disruptions.
• Implement exponential backoff. When you receive a 429, wait for the duration specified in Retry-After, then retry with increasing delays if the limit is still exceeded.
• Batch where possible. Use list endpoints with pagination instead of fetching resources one at a time.
• Separate read and write traffic. Read operations (list, get) generally have higher limits than write operations (create, update, delete).