Methodology
API rate-limit headers
ia.api-rate-limits · 4.23
Act
MAY
Recommendation
AR-ACT-02
Why it matters
Rate-limit headers let agents pace themselves before they hit a 429, and document the quota alongside the API instead of in prose only.
How to fix it
Send RateLimit and RateLimit-Policy headers on API responses.
-
Add the IETF RateLimit and RateLimit-Policy headers to API responses.
RateLimit-Policy: "hourly";q=100;w=3600 RateLimit: "hourly";r=42;t=1800 -
Add Retry-After to each 429 response.
Verify
curl -sI https://{domain}/api/
Expected: RateLimit or RateLimit-Policy headers
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.api-rate-limits
Details Mapping, lifecycle and references
- AR mapping
- Partial match
- Evidence source
- agentready.org AR-ACT-02
- Score role
- Bonus
- Introduced
- 2026-08-25
- Revised
- 2026-09-02
- Methodology version
- 2026-10-22