Rate limits

Honor Retry-After. Do not load-test production.

Every authenticated response carries the caller's position in the rolling window:

Header	Meaning
`X-RateLimit-Limit`	Requests allowed in the window
`X-RateLimit-Remaining`	Requests still available
`X-RateLimit-Reset`	Unix timestamp when the oldest request leaves the window
`Retry-After`	Seconds to wait after a `429`

GET /api/partner/rate-limit reports the live window for the authenticated principal. For a service-account caller the keys collection is empty; budget lives on data.principal. Checking status is metered against its own budget.

Guidance, hard, and burst ceilings are principal policy. Cloud Armor is an emergency per-IP backstop, not identity-aware. Redis remains authoritative for per-principal limits.

Retries and backoff

Retry only idempotent GET on selected transient network failures and 502 / 503 / 504.
Honor Retry-After on 429 and 503 when present.
Do not retry POST from these docs.
Bound timeout and retry count. Log operation, status, latency, retry count, and request id. Redact Authorization and financial bodies.

Load testing

Do not load-test production. UAT load generation is a separately reviewed exercise; these docs are not permission to soak either environment. If you need higher guidance limits, escalate to the Enterprise Systems Team rather than retrying past 429.

Pagination and queries

Errors and troubleshooting