Rate limits - Tera Contracted Supplier API

Limits are enforced primarily by authenticated supplier / credential identity. IP is a secondary control. Failed authentication has its own limiter.

Production defaults

Account configuration may tighten these. They are not volume-based pricing.

Operation	Steady	Burst
Create	10 / minute	20
Poll (GET)	60 / minute	120
Contact correction	5 / minute	10
Promotion	5 / minute	10
Failed authentication	10 / minute / IP	20

A secondary IP ceiling applies after authentication so a single source address cannot exhaust shared infrastructure.

429 response

HTTP/1.1 429 Too Many Requests
Retry-After: 12
RateLimit-Limit: 10
RateLimit-Remaining: 0
RateLimit-Reset: 1787990460
X-Request-Id: req_01HZX4K2N8M3Q7P

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Retry after the Retry-After header."
  }
}

Backoff using Retry-After. Do not rotate external_reference to bypass a limiter. Do not expect X-RateLimit-* headers.

503 when the limiter is unavailable

Rate limiting is fail-closed. If Upstash is missing while the Supplier API is enabled, or the limiter cannot be reached, public routes return 503 with error.code service_unavailable. Retry later. Do not treat this as a successful request and do not assume the limiter is disabled.