Rate limits

MarkUp limits how many requests each caller can make in a short window. Every request spends points: reads (GET) cost 1 point, writes (POST, PUT, PATCH, DELETE) cost 3.

Who shares a limit

Caller	Limit shared by
API key (server-to-server)	Your whole organization, across all of its API keys and IP addresses
SDK	Each signed-in end user; during sign-in, each IP address
API key and webhook management	Each IP address

Your integration’s traffic and your SDK users’ traffic never share a limit, so a busy sync job can’t slow your reviewers down.

Response headers

Responses to API key and SDK requests report the limit they were counted against:

Header	Meaning
`x-ratelimit-limit`	Points the current window allows
`x-ratelimit-remaining`	Points left in the current window
`x-ratelimit-reset`	When the current window resets, as a Unix timestamp in seconds

Values are points, not requests. A short burst can still succeed after the window is spent; while it does, x-ratelimit-remaining reads 0. API key and webhook management responses don’t carry these headers. Some endpoints also have a limit of their own, and a 429 from one of those carries only retry-after.

When you exceed a limit

The request fails with 429 Too Many Requests and a retry-after header giving the seconds to wait before retrying:


{
    "error": {
        "code": "TOO_MANY_REQUESTS",
        "message": "Too Many Requests",
        "requestId": "..."
    }
}

The SDK waits and retries for you. Requests rejected for missing or invalid credentials (401 or 403) or for an endpoint that doesn’t exist (404), and API key and webhook management requests that fail, are limited per IP address too. Once that limit is spent, every request from that IP address is refused until it resets, including valid ones, so fix the request rather than retrying. Requests refused because your plan or account doesn’t include the Public API (402 or 403) count against your own limit, like any other request.

If you send too many requests at once from one IP address, the excess can fail with 429. Retry after the retry-after delay, and back off further if a retry is refused again.

Higher limits

Limits can be raised for your organization. Contact MarkUp support with the integration or SDK traffic you expect.