> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rigaly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Request limits and how to handle 429 responses

Limits are applied **per API key**:

| Scope                                                                        | Limit                 |
| ---------------------------------------------------------------------------- | --------------------- |
| All endpoints (default)                                                      | 120 requests / minute |
| Points writes (`/points/issue`, `/points/redeem`, `/redemptions/*/complete`) | 60 requests / minute  |
| Code batches (create, export)                                                | 10 requests / minute  |

Every response carries standard rate-limit headers:

```
RateLimit-Limit: 120
RateLimit-Remaining: 87
RateLimit-Reset: 42
```

## Handling 429

When a limit is exceeded the API returns `429` with:

```json theme={null}
{
  "success": false,
  "error": {
    "message": "Too many requests, please try again later",
    "type": "RATE_LIMIT_EXCEEDED",
    "retryAfter": 60
  }
}
```

Back off and retry after `RateLimit-Reset` seconds. For batch workloads (e.g. issuing points for many orders), spread requests out rather than bursting — 60 writes/minute is one per second sustained.

<Tip>
  Issuing points for many customers at once? The dashboard's **Bulk Points** CSV upload handles up to 1,000 rows in one operation without consuming API rate limit.
</Tip>

## Idempotent retries

Write endpoints accept an optional `Idempotency-Key` header. If a request times out or errors mid-flight, retry with the **same key** — within 24 hours you'll get the original response back (marked with `Idempotency-Replayed: true`) instead of a duplicate operation.

```bash theme={null}
curl -X POST https://api.rigaly.com/api/v1/points/issue \
  -H "Authorization: Bearer rgly_sk_YOUR_KEY" \
  -H "Idempotency-Key: order-1042-points" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "customer@example.com", "points": 500}'
```

Use a key that identifies the operation (e.g. your order ID), not a random value per attempt.