Rate limits & quotas

Overview#

Qtangl applies limits at several layers. Authenticated write routes share a per-key requests-per-minute budget. Authenticated read routes (including PQC scan polling) do not count toward that budget. Public verify, transparency, and Readiness Index routes use a separate per-IP limit. Signup and lead-capture forms have abuse caps. Discovery and remediation have additional tenant-scoped limits. Monthly scan caps are tier entitlements and return 402 Payment Required, not 429.

For authentication schemes and RBAC, see Authentication & RBAC. For key hygiene and transport security, see Security & compliance.

Authenticated API — 300 req/min per key#

The backend enforces 300 requests per minute per API key by default on authenticated write routes. Operators can override with QTANGL_RATE_LIMIT_PER_MINUTE; values below 300 are ignored. When REDIS_URL is set, counters are distributed across instances; otherwise each process keeps an in-memory sliding window.

Every response includes informational headers X-RateLimit-Limit and X-RateLimit-Window: 60. Rate-limit counter state uses a rolling 60-second window — see Data retention.

Routes under /admin/* use a separate admin key and are not counted. Unauthenticated health routes are unlimited.

Write routes (count toward limit)

Read routes (exempt from global counter)

This exemption is intentional: polling GET /pqc/scan/{scanId} during a scan workflow does not consume your write budget.

Public endpoints — 60 req/min per IP#

Verify, transparency log, Readiness Index, and dogfood routes are public — no API key required. They share a default limit of 60 requests per minute per client IP, keyed from X-Forwarded-For or the connection host. Override with QTANGL_VERIFY_RATE_LIMIT_PER_MINUTE and QTANGL_VERIFY_RATE_WINDOW_SEC. Responses include a Retry-After header on 429.

Signup and lead capture#

Self-serve signup and marketing forms are rate-limited per email domain to reduce abuse.

Discovery limits#

Host discovery scan enqueue and agent findings ingest have separate tenant-scoped limits. These require Redis; when Redis is unavailable, discovery rate limits are not enforced.

Tier quotas (402, not 429)#

Monthly scan counts, schedule caps, and API key limits are subscription entitlements. Exceeding a monthly scan quota returns 402 Payment Required with a scan_quota_exceeded code — not a rate limit. Production live scans also require legal acceptance and trial or paid status.

Upgrade via the billing portal or pricing.

Remediation flip budget#

Crypto flip automation enforces a policy budget of 50 flips per day per tenant, with a 24-hour cooldown between KMS production flips. Exceeding the budget returns a policy rejection in the response metadata — not HTTP 429.

429 and 402 responses#

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 300
X-RateLimit-Window: 60

{
  "detail": "Rate limit reached. The pilot API allows 300 requests per minute per key."
}

Client patterns#

• Poll GET /pqc/scan/{scanId} freely — read routes are exempt from the 300/min write counter.
• Send Idempotency-Key on POST /pqc/scan to avoid duplicate scans when retrying after 429 or network errors.
• Exponential backoff with jitter on 429; respect Retry-After on public routes.
• Official SDKs (TypeScript and Python) treat 429 as retryable with exponential backoff.
• Cache optimize results when inputs have not changed.

Operator environment variables#