> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Per-action rate limits, plan quotas, the 429 response shape, and exponential backoff.

The Dacard.ai API runs three kinds of throttling. They stack. A request must clear every layer to succeed.

1. **Per-action rate limits**, short-window throttles on burst behavior. Source: `packages/core/src/rate-limit.ts`.
2. **Plan quotas**, monthly credit pools and feature gates. Source: `packages/shared/src/plans.ts`.
3. **Per-tier API call ceilings**, Business and Enterprise only.

## Per-action rate limits

| Action | Limit | Window | Endpoint |
| - | - | - | - |
| `score` | 5 requests | 60 seconds | `POST /api/score`, `POST /api/score/quick`, `POST /api/score/product` |
| `chat` | 30 requests | 60 seconds | `POST /api/chat` |

The limit returns `429 Too Many Requests` with a `Retry-After` header. Hits are tracked per `userId` against a 60-second sliding window. The gate fails closed if the database is unreachable.

There is no per-action rate limit on `api` (API key calls). They are tracked but enforced through the per-tier monthly ceiling.

## Plan quotas

| Plan | Monthly credits | Scores | Chat messages | API calls/mo | Products | Seats |
| - | - | - | - | - | - | - |
| Free | 80 | 3 | 30 | 0 | 1 | 1 |
| Pro | 1,000 | up to 100 | up to 1,000 | 0 | 5 | 3 |
| Business | 2,000 | up to 200 | up to 2,000 | 25,000 | 25 | 10 |
| Enterprise | Unlimited | Unlimited | Unlimited | 100,000 | Unlimited | Custom |

Free and Pro do not include programmatic API access. Mint API keys on Business or Enterprise from `Settings > API Keys`.

Numerics live in `packages/shared/src/plans.ts`. The source file is authoritative.

Check live consumption with [Get Usage and Quota](https://docs.dacard.ai/api-reference/user/get-usage-and-quota.md).

## 429 response shape

```http theme={null}
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60

{
  "error": {
    "code": "SCORING_RATE_LIMITED",
    "message": "Too many reads in a row.",
    "action": "Give it 60 seconds and try again.",
    "retryable": true
  }
}
```

Plan-quota exhaustion returns `402` with `code: "CREDIT_EXHAUSTED"` or `code: "PLAN_LIMIT_REACHED"`. Those are not retryable. See [Errors](https://docs.dacard.ai/api-reference/errors.md).

## Exponential backoff

```ts theme={null}
async function callWithBackoff<T>(fn: () => Promise<Response>): Promise<T> {
  for (let attempt = 0; attempt < 5; attempt++) {
    const res = await fn();
    if (res.ok) return res.json() as Promise<T>;

    if (res.status !== 429) {
      const body = await res.json().catch(() => ({}));
      throw new Error(body.error?.message ?? `HTTP ${res.status}`);
    }

    const retryAfter = Number(res.headers.get('Retry-After') ?? 60);
    const jitter = Math.random() * 0.25 * retryAfter;
    const delay = (retryAfter + jitter) * 1000 * Math.pow(1.5, attempt);
    await new Promise((r) => setTimeout(r, delay));
  }
  throw new Error('Exceeded max retries on 429');
}
```

Cap retries. A user staring at a spinner is a worse experience than a clear error.

## Anonymous scoring

`POST /api/score` (no session) and `POST /api/score/quick` accept anonymous reads at 1 per IP per hour. The result is held until a sign-up links it via `POST /api/score/link`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.