{"id":"ia.api-rate-limits","name":"API rate-limit headers","verify":{"command":"curl -sI https://{domain}/api/","rescan":"isagentready results {domain} --checkpoint ia.api-rate-limits","expect":"RateLimit or RateLimit-Policy headers"},"fix":{"steps":[{"action":"Add the IETF RateLimit and RateLimit-Policy headers to API responses.","order":1,"language":"text","code_example":"RateLimit-Policy: \"hourly\";q=100;w=3600\nRateLimit: \"hourly\";r=42;t=1800"},{"action":"Add Retry-After to each 429 response.","order":2,"language":null,"code_example":null}],"summary":"Send RateLimit and RateLimit-Policy headers on API responses.","skill":{"name":"agent-protocols","anchor":"ia.api-rate-limits"}},"category":"agent_protocols","aggregate":null,"references":[{"title":"Active Internet-Draft: RateLimit header fields for HTTP","kind":"spec","url":"https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/"},{"title":"RFC 9651: Structured Field Values for HTTP","kind":"spec","url":"https://www.rfc-editor.org/rfc/rfc9651"},{"title":"RFC 6585 section 4: 429 Too Many Requests","kind":"spec","url":"https://www.rfc-editor.org/rfc/rfc6585#section-4"}],"stage":"act","lifecycle":{"introduced":"2026-08-25","revised":["2026-09-02"],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"emerging","evidence_source":{"title":"agentready.org AR-ACT-02","url":"https://www.agentready.org/#act"},"why":"Rate-limit headers let agents pace themselves before they hit a 429, and document the quota alongside the API instead of in prose only.","profiles":["api_tool_readiness"],"score_role":"bonus","legacy_id":"4.23","i18n":{"nl":{"name":"Rate-limit-headers van de API","steps":["Voeg de IETF-headers RateLimit en RateLimit-Policy toe aan API-responses.","Voeg Retry-After toe aan elke 429-response."],"why":"Rate-limit-headers laten agents hun tempo aanpassen voordat ze een 429 krijgen. Ze documenteren het quotum naast de API en niet alleen in tekst.","fix_summary":"Stuur RateLimit- en RateLimit-Policy-headers op API-responses.","verify_expect":"Headers RateLimit of RateLimit-Policy"}},"ar_practice_ids":["AR-ACT-02"],"strength":"MAY","ar_mapping":"partial","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.api-rate-limits","maturity":"emerging","applicability":{"mode":"detected_surface","condition":null,"surfaces":["api"]}}