Limits and quotas
The caps every request is checked against, and the headers that report your quota.
Rate-limit headers
A successful optimize call carries X-RateLimit-Limit (the ACCOUNT’s monthly cap — every key on the account shares one) and X-RateLimit-Remaining (calls left this month on the account, after this one). They are sent by the optimize endpoints only: the counter is reserved as part of authorizing a solve, so /v1/usage and /v1/health have nothing to report.
| Field | Type | Description |
|---|---|---|
| X-RateLimit-Limit | integer | The ACCOUNT's monthly quota, not this key's: api_authorize compares the month's calls summed over EVERY key on the account against the largest monthly_quota frozen onto any of its ACTIVE keys (migrations 049 + 053). It is the same number GET /v1/usage returns as limit. More keys do not add allowance. On an answer to the public demo key (X-CutOptim-Demo: true) it is instead the per-address DAILY demo allowance. |
| X-RateLimit-Remaining | integer | Calls left on the ACCOUNT in the current UTC calendar month AFTER this one — account-wide for the same reason X-RateLimit-Limit is. Sent only on a successful optimize: the counter is reserved as part of authorizing the request, so /v1/usage and /v1/health have nothing to report. On a demo answer: demo calls left today from this address. |
| Retry-After | integer | Sent with 402 and 409 and 429 only. 402: Seconds until the quota resets — i.e. until 00:00 UTC on the 1st of next month. 409: Sent with idempotency_in_progress: seconds to wait before retrying. 429: Seconds to wait before retrying. |
| X-CutOptim-Demo | "true" | Present, with the value true, only on an answer to the public demo key — refusals included. The demo key has no account: its 200s carry one extra warnings line saying so, and the two X-RateLimit-* headers count the per-address daily demo allowance. |
| Idempotency-Replayed | "true" | Present, with the value true, only when this answer is a stored one returned for a repeated Idempotency-Key. The body and the X-RateLimit-* values are those of the first answer. |
Limits
- 2,000 parts per request (total quantity, after qty expansion)
- 50 stock rows · request body up to 1 MB
- include "pdf": at most 500 parts per request (total quantity)
- 10 active keys per account — they share ONE monthly quota, so keys separate environments and integrations, they do not add allowance
- 10 MB request body on the two nest paths that may carry a drawing (/v1/optimize/nest and /v1/import/nest); one source file is at most 4,000,000 characters, 8,000,000 across a request
- concurrency is bounded server-side — solves run one at a time behind a short queue (about 8 s); a burst beyond it gets 429, and a refused request is never charged. The keyless validate endpoints additionally have a per-address ceiling (429 with Retry-After); a working key is never throttled that way.
An address that presents more than 30 unknown API keys in a minute is refused (429) for the rest of that minute, before any key lookup. An account may hold 5 max jobs queued or running at once.
- Idempotency-Key: 8–128 characters of A-Z a-z 0-9 _ -; a key and its stored answer are kept for 24 hours, per account and key type (test or live); the public demo key ignores it
- webhooks: up to 5 endpoints per account; answer within 10 s or the delivery is retried — 8 attempts over 24 hours; the delivery log is kept 30 days
Is an engine down? The status page shows the live state of the website, the Engine API, the nesting engine and the async max engine: Service status ↗