> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Risk-tier budgets, headers, and how to handle 429.

Aquila limits by risk, not by volume. Reads draw no budget, so you can move
between pages and agents without seeing `429`. Limits apply only where abuse
has a real cost.

## Tiers

Each tier is its own bucket. A heavy call never eats the budget of an
unrelated page.

| Tier      | Budget        | Typical calls                           |
| --------- | ------------- | --------------------------------------- |
| Read      | Unlimited     | Lists, details, timelines, dashboards   |
| Write     | 20 per minute | Creates, updates, deletes               |
| Expensive | 10 per minute | Scan starts, agent runs, LLM generation |
| Sensitive | 20 per minute | Credential reveal and rotation          |
| Bulk      | 60 per minute | Bulk-delete enqueues                    |

Rules:

* The budget is per user, keyed by your session or API key. Unauthenticated
  callers share a per-IP bucket.
* Windows slide. Counters live in Postgres.
* The limiter is best-effort. During a cache outage requests pass through
  rather than fail.

## Auth routes

Better Auth runs its own limiter on `/api/auth/*` before the platform tiers:

| Endpoint                   | Limit                 |
| -------------------------- | --------------------- |
| Default                    | 100 per minute        |
| `/sign-in/email`           | 3 per 10 seconds      |
| `/sign-up/email`           | 5 per minute          |
| `/forget-password`         | 2 per minute          |
| `/two-factor/verify`       | 3 per 10 seconds      |
| `/send-verification-email` | 1 per cooldown window |
| `/get-session`             | 60 per minute         |

## Headers

Limited responses carry these headers:

* `X-RateLimit-Limit` — the tier budget.
* `X-RateLimit-Remaining` — the calls still available in the window.
* `X-RateLimit-Reset` — when the window resets.

A `429` response also carries `Retry-After`. Wait that long, then send the
request again. Reads never return `429`.