Rate limits

Sailor applies shared, cross-machine limits before executing an API operation. Limits are tenant-fair: one credential or workspace cannot consume another workspace’s quota.

Current Limits

Listing outcomes costs 1 unit. Creating, updating, or deleting an outcome costs 5 units. Smart List configuration reads cost 2 units, configuration writes cost 5 units, member reads cost 3 units, and bounded member mutations cost 10 units. Creating a staff invitation costs 20 units to bound invitation and email-delivery abuse. Rejected credential/workspace quota decisions are atomic: Sailor does not charge one authenticated bucket when the other bucket rejects the request.

Failed authentication attempts also have an abuse limit by authoritative client IP. A non-consuming distributed precheck rejects an IP before key lookup only after earlier failed authentication exhausted that bucket. Valid keys never spend this IP budget, so unrelated customers behind the same NAT remain isolated by their credential and workspace quotas.

Response Headers

Authenticated responses include:

When a quota or concurrency control rejects a request, Sailor also returns Retry-After in whole seconds. Header syntax follows IETF RateLimit draft 11 while the standard remains in progress; parse fields defensively rather than depending on field order.

Retry Safely

1. Stop sending new requests for the affected key.
2. Wait at least the Retry-After duration.
3. Add bounded exponential backoff with jitter.
4. For writes, reuse the original Idempotency-Key and exact request data.
5. Cap retries and alert on sustained 429 or 503 responses.

Do not rotate keys to evade limits. All keys in a workspace share the workspace quota.