Limits and retries
Rate limits
| What | Limit |
|---|---|
Reads (GET) | 120 requests a minute per token |
Changes (POST, PUT, PATCH, DELETE) | 30 requests a minute per token |
| Through an AI assistant (MCP) | another 60 tool calls a minute |
Past a limit you get a 429 with the code token_rate_limited and a Retry-After header saying how many seconds to wait. Server state changes every few seconds at most, so polling it more often than every 5–10 seconds gains nothing.
Price first
Methods that take money (renting, renewing, changing plans) accept "preview": true. With it the API prices the request with the same code as the real purchase and charges nothing:
HTTP/2 200 OK
{
"total": 855,
"monthly": 285,
"base": 300
}Retrying without paying twice
Every request that spends money needs an Idempotency-Key header — any unique string up to 200 characters, one per purchase.
curl -X POST "https://sourhost.net/api/v1/projects/12/services/34/extend" \
-H "Authorization: Bearer $SOURHOST_TOKEN" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: extend-34-2026-11" \
-d '{"months":1}'How it works:
| Situation | What happens |
|---|---|
| A new key | The purchase runs; the answer is kept for 24 hours |
| The same key, the first request finished | Nothing is charged; you get the first answer with Idempotent-Replayed: true |
| The same key, the first request still running | 409 idempotency_in_progress — wait and check the result |
The first request failed with a 5xx | The answer isn't kept; retry with the same key |
If the connection dropped and you don't know whether the purchase went through, retry with the same key. A new purchase needs a new key.
The token's spending limit
A token with billing:spend always comes with a 24-hour and/or 30-day limit. A purchase past it is refused with 403 token_spend_limit and nothing is charged. See API tokens.