> ## Documentation Index
> Fetch the complete documentation index at: https://developer.maatstays.wtf/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> 600 requests an hour per key, announced on every response.

The contract endpoints share one quota: **600 requests an hour per API key**, across
all of them together. It is sized for a nightly catalogue sync plus a live calendar
feed for a mid-size portfolio; if your integration legitimately needs more, that is a
conversation with your Maat contact, not something to engineer around.

Every response announces where you stand:

| Header                | Meaning                                      |
| :-------------------- | :------------------------------------------- |
| `RateLimit-Policy`    | The quota and its window, e.g. `600;w=3600`. |
| `RateLimit-Limit`     | The quota.                                   |
| `RateLimit-Remaining` | What is left in the current window.          |
| `RateLimit-Reset`     | Seconds until the window resets.             |

Going over answers `429` with `code: "rate_limited"` and a `Retry-After` header giving
the wait in seconds. Honour it — the window does not reset faster because you keep
asking.

## Budgeting a sync

Three properties of the API keep a well-shaped integration comfortably inside the
quota:

* **Unchanged pushes are cheap for you to skip.** Both inbound contracts are idempotent
  `PUT`s keyed by your own identifier, so you can safely push only what changed since
  your last sync — and re-push everything after any doubt.
* **Unchanged photo URLs cost nothing**, so a full catalogue push does not re-process
  images — see [Properties](/guides/properties).
* **Read `RateLimit-Remaining` as you go** rather than counting requests yourself, and
  smooth large syncs over the hour rather than bursting them.

## The token exchange is counted separately

`POST /v1/token` has its own, separate ceiling — it does not draw from the 600. Mint
one token per batch of work, not one per request: a token lives fifteen minutes by
default, which is an entire sync's worth of calls under one exchange. An integration
that exchanges a key per request will meet the exchange's ceiling long before the
contract quota.