Rate limits

The Public API applies multiple protection layers:

Pre-auth IP limit — invalid-key spraying is throttled before key validation.
Per-key limit — authenticated requests are limited per API key.
Write quotas — email sends and scheduled-prompt runs have daily caps.

When limited, the API returns 429 with a standard error envelope.

Write quotas

Operation	Default daily limit (per org + key)
Scheduled prompt `run`	50
Notification `schedule`	100

Idempotency

POST and PATCH write endpoints require an Idempotency-Key header. Keys are scoped per organization and API key so replays cannot collide across tenants.