Rate limits and errors

Rate limits

Caller	Limit
REST API token	120 requests a minute per token (a bucket of 120 refilling at 2 a second). `429 rate_limited` with `Retry-After: 2`.
Any request without a session cookie (so every token request)	300 a minute per client address, across all routes. `429` with the same error shape.
A signed-in dashboard session	1,200 a minute per address. This is the browser's limit, not a token's.
MCP	30 requests burst then 1 a second per token, and 5,000 tool calls per organisation per UTC day.
Log exports (`logs.csv`, `logs.jsonl`)	6 an hour per organisation, up to your plan's row cap (100,000 on Operator, 1,000,000 on Network).

On a 429, wait for Retry-After seconds. For timeseries and domain-query, batch several metrics in one call instead of one call per metric.

Error format

json

{"error":{"code":"plan_required","message":"The REST API needs the Network plan; this organisation is on free","details":{"feature":"rest_api","plan":"free","required_plan":"network"}}}

Branch on code, not message. details is optional.

Status	Code	Meaning
401	`invalid_token`	Missing, revoked or expired token, or its owner left the organisation. The response has `WWW-Authenticate: Bearer`.
403	`insufficient_scope`	The token was created for MCP only.
403	`plan_required`	The organisation is not on Network, or a feature (`details.feature`) needs a higher plan.
403	`forbidden`	The token owner's role cannot read this, for example staff asking for player data.
404	`not_found`	Not a token route, a malformed path, another organisation, or no such server.
405	`read_only`	Only GET and HEAD are accepted. `Allow: GET, HEAD`.
429	`rate_limited`	Too many requests.
400	`bad_request`	A parameter failed validation.

Conventions

Times are ISO 8601 strings or Unix milliseconds in query parameters. Responses carry ISO strings.
Money is in minor units (cents) of your store currency. Gamemode amounts are integers in the in-game currency's minor units with its scale in currencies.
Ranges (from, to) are clamped to your plan. The response has history_limit: {plan, days, earliest} when it clamped, otherwise null.
Responses are Cache-Control: no-store.
Org-wide list routes take server=<server> to narrow to one server.
Org day and week boundaries follow the organisation timezone in the routes that group by day.