Rate Limits

Sourced from the backend implementation, not yet in the spec

openapi.json does not declare any rate-limit values, headers, or policy — the number below is confirmed directly from the backend’s throttle configuration, not from the generated spec. If the backend changes this configuration, this page can drift out of date faster than usual.

Limit

300 requests per minute, per X-API-Key credential.

• The limit applies per credential, not per IP and not per tenant as a whole — two different credentials for the same tenant each get their own 300/min budget.
• It’s a single shared budget across the whole API — menu, orders, and hotels endpoints all draw from the same per-credential 300/min limit, not separate limits per endpoint.
• There is currently no mechanism to request a higher limit for a specific credential.

Exceeding the limit

A request over the limit returns 429 Too Many Requests with the standard error envelope:

HTTP/1.1 429 Too Many Requests
Retry-After: 42

{
  "code": "rate_limited",
  "message": "Too many requests."
}

The Retry-After header (seconds until you can retry) is included — respect it rather than retrying immediately.

Recommended approach

• Track your own request rate per credential and stay under 300/min rather than relying on hitting 429 as your primary signal.
• On 429, back off for at least the Retry-After value before retrying, and use exponential backoff if you hit it repeatedly.
• If your integration legitimately needs a higher sustained rate, talk to RestroLab rather than working around the limit with retries.