---
title: "Rate limits"
description: "600 requests a minute per workspace, the headers that tell you where you stand, and what to do with a 429."
canonical: https://docs.mentio.dev/rate-limits
markdown: https://docs.mentio.dev/rate-limits.mdx
---

# Rate limits

600 requests a minute per workspace, the headers that tell you where you stand, and what to do with a 429.

A workspace may make 600 requests a minute, counted across every API key and OAuth token it holds, on a sliding window (a request stops counting sixty seconds after it was made). MCP tool calls count into the same window. The dashboard's own traffic does not.

Every counted response carries three headers:

| Header                  | Meaning                                |
| ----------------------- | -------------------------------------- |
| `X-RateLimit-Limit`     | Requests admitted per minute (600).    |
| `X-RateLimit-Remaining` | Requests left in the current window.   |
| `X-RateLimit-Reset`     | Unix seconds when the next slot frees. |

Past the limit a request answers `429` with the `rate_limited` code, a `Retry-After` header (seconds) and `retryAfterSeconds` in the body; wait that long and send the same request again. Two endpoints keep a tighter cap of their own, since each scans up to ten thousand rows: the CSV exports of mentions and of people, 6 a minute each.

## Handling a 429

Read `Retry-After` (or `retryAfterSeconds` in the body), wait that many seconds, and send the same request again. The SDKs and the CLI do not retry on their own: they return the 429 like any other error, so the wait is yours to write. Spreading a large job over time is cheaper than retrying: 600 a minute is ten a second, enough to page through every mention of a busy workspace without touching the limit.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this workspace; retry in 12 s",
    "retryAfterSeconds": 12,
    "requestId": "3f9c1e2a-7b4d-4c1e-9a0b-2d5e6f7a8b9c"
  }
}
```

The limit is per workspace, not per key: two scripts on two keys of the same workspace share the 600. The dashboard never counts, so a script at its limit never locks you out of the app.