Rate limits

REST and MCP share a budget of 60 non-computation-domain read requests per rolling minute per client. Computation-domain access has a separate shared budget of 30 requests per rolling minute per client, covering catalog access (GET /api/v1/computations, list_computations, and the catalog resource) as well as batch and rollover execution.

A shared pre-authentication budget of 90 requests per rolling minute per source IP covers OAuth token requests plus REST and MCP authentication work. Token minting is separately limited to 30 attempts per rolling minute per verified client across source IPs. Overall traffic from a single source IP is limited to 500 requests per five minutes. Request bodies are limited to 256 KiB.