Requests are rate-limited per agent key (fixed window). The default is set by the platform (AGENT_DEFAULT_RATE_LIMIT_PER_MIN); a key can carry its own rate_limit_per_min override set at creation.
  • Scope: agent_key:<key_id> (or the account for JWT callers).
  • Exceeding the window → 429 with error_code: RATE_LIMIT_ERROR.
  • The unauthenticated GET /health probe is exempt.

Handling 429

Back off exponentially and retry. Because mutations are idempotent, retrying a 429’d POST with the same Idempotency-Key is safe.
Need more throughput for a specific agent? Mint its key with a higher rate_limit_per_min, or split work across role-specific keys.