Some routes limit how many requests you can send in a time window. Over the limit you get 429 rate_limited and a Retry-After header with the seconds to wait. Other routes have no request limit; they are limited by what your plan allows instead, such as running sessions.

The limits

Route	Limit	Counted per
Create a session (POST /v1/sessions)	120 per minute	project
Stop, resume or delete in bulk (POST /v1/sessions/bulk)	30 per minute	project
Stop, resume or delete one session (POST /v1/sessions/:id/stop, POST /v1/sessions/:id/resume, DELETE /v1/sessions/:id; a bulk call counts as one)	60 per minute	project
Messages to a working agent run (POST /v1/agent/runs/:id/messages)	10 per minute per run, 60 per minute per project	run and project
Sign-ins saved from a session (POST /v1/profiles with fromSession)	30 per minute	project
Start an agent run, a task run or resume a run that stopped early (POST /v1/agent/runs, POST /v1/tasks/:id/runs and POST /v1/agent/runs/:id/resume), and a login action, together	30 per minute	project
Task changes (create, PATCH, DELETE)	60 per minute	project
Credential changes (POST, PATCH and DELETE /v1/credentials, a pushed code or link POST /v1/credentials/:name/codes, and PATCH /v1/profiles/:id when it sends credential)	60 per minute	project
2FA codes from boxline-otp in a session's shell (POST /v1/sessions/:id/otp; a wait asks again about every 20 seconds, each ask counts)	60 per minute	session
Extract (POST /v1/extract)	30 per minute	project
Fetch, screenshot and PDF, together	120 per minute	project
Start a crawl (POST /v1/crawls)	10 per minute	project
Search the web (POST /v1/search; each page its fetch opens also counts as a fetch)	60 per minute	project
Computer-use actions (POST /v1/sessions/:id/browser/computer)	300 per minute	session
Reading the files of a stopped session (GET /v1/sessions/:id/files and /files/archive on a STOPPED session)	60 per minute	project
Screenshots (screenshot actions and computer-use screenshots, together)	300 per minute	session
Upload an extension (POST /v1/extensions)	30 per hour	project
Webhook endpoint changes (create, PATCH (rotateSecret too), DELETE)	60 per minute	project
Webhook test events and delivery retries, together	10 per minute	project
Create an API key (POST /v1/project/api-keys)	20 per hour	project
Sign up	5 per hour	IP address
Log in	20 per 15 minutes, and 10 per 15 minutes per email	IP address and email
Ask for a password reset	10 per hour, and 3 per hour per email	IP address and email
Confirm a password reset	30 per 15 minutes	IP address
Change your password (signed in)	10 per 15 minutes	user
Email a confirmation code (POST /v1/auth/confirm-email/send)	5 per hour per user, 10 per hour per IP address	user and IP address
Email confirmation codes in a day	10 per day	account (counted in the database, so it holds across servers and restarts)
Try a confirmation code (POST /v1/auth/confirm-email)	15 per hour per user, 30 per 15 minutes per IP address	user and IP address
Send an invitation (POST /v1/organizations/:id/invites)	20 per hour for the organization, and 20 per hour for the person inviting	organization and user
Look up an invitation (POST /v1/invites/lookup)	30 per 15 minutes	IP address
Accept an invitation (POST /v1/invites/accept, and a sign-up with an invitation)	20 per 15 minutes	user (IP address for a sign-up)
Create a project (POST /v1/organizations/:id/projects)	20 per hour	organization
Change an organization: rename, transfer, members and projects, withdraw an invitation, leave	60 per minute	organization
New Idempotency-Key values, on any route	300 per minute	project

The windows are fixed: a minute window starts with the first request and resets a minute later. Limits are counted on each API server, so the exact point where you are stopped can vary a little. Treat the numbers as the most you should send.

Headers

Every response of a limited route, the 429 too, tells you where you stand:

Header	Meaning
`RateLimit-Limit`	Requests allowed in the current window.
`RateLimit-Remaining`	Requests left in this window.
`RateLimit-Reset`	Seconds until the window starts again.
`Retry-After`	On 429 only: seconds to wait before trying again.

Logging in shows its per-IP limit only, and so do password reset requests. The per-email limit still answers 429 with Retry-After, but its numbers are never shown. A request that replays an earlier response for an Idempotency-Key counts against the route’s limit like any other request.

A limited response

HTTP/1.1 429 Too Many RequestsRetry-After: 42RateLimit-Limit: 30RateLimit-Remaining: 0RateLimit-Reset: 42X-Request-Id: req_4fJx0aQm2Lk9Pz7N{"error":{"code":"rate_limited","message":"too many requests; try again in 42 s","requestId":"req_4fJx0aQm2Lk9Pz7N"}}

Back off

Slow down when RateLimit-Remaining gets close to 0, before you are stopped.
On 429, wait Retry-After seconds, then try again.
Spread batch work out, or queue it, rather than sending everything at once.
The Node and Python SDKs wait for Retry-After and try again by themselves, up to 60 seconds and 2 retries by default.

Other limits

Running sessions: your plan’s concurrency, shared by all the projects of your organization, and a project’s own concurrencyCap if it has one. Over either you get 429 concurrency_limit with Retry-After: 5. It has no RateLimit-* headers, because it is about running sessions, not the request rate. Try again after 5 seconds, or when one of your sessions stops. See Configuring sessions and A cap for one project.
Model spend and proxy data: monthly caps of the organization, 402 spend_limit. See Pricing.

These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.