> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terabusinessfinance.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Identity-primary limits, secondary IP limits, and the failed-authentication limiter.

Limits are enforced primarily by authenticated supplier / credential identity. IP is a secondary control. Failed authentication has its own limiter.

## Production defaults

Account configuration may tighten these. They are not volume-based pricing.

| Operation             | Steady           | Burst |
| --------------------- | ---------------- | ----- |
| Create                | 10 / minute      | 20    |
| Poll (GET)            | 60 / minute      | 120   |
| Contact correction    | 5 / minute       | 10    |
| Promotion             | 5 / minute       | 10    |
| Failed authentication | 10 / minute / IP | 20    |

A secondary IP ceiling applies after authentication so a single source address cannot exhaust shared infrastructure.

## 429 response

```http theme={null}
HTTP/1.1 429 Too Many Requests
Retry-After: 12
RateLimit-Limit: 10
RateLimit-Remaining: 0
RateLimit-Reset: 1787990460
X-Request-Id: req_01HZX4K2N8M3Q7P
```

```json theme={null}
{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Retry after the Retry-After header."
  }
}
```

Backoff using `Retry-After`. Do not rotate `external_reference` to bypass a limiter.

Do not expect `X-RateLimit-*` headers.

## 503 when the limiter is unavailable

Rate limiting is fail-closed. If Upstash is missing while the Supplier API is enabled, or the limiter cannot be reached, public routes return `503` with `error.code` `service_unavailable`. Retry later. Do not treat this as a successful request and do not assume the limiter is disabled.