> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.sailorhq.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.sailorhq.io/_mcp/server.

# Rate limits

> Build reliable clients around Sailor quotas and concurrency controls.

Sailor applies shared, cross-machine limits before executing an API operation. Limits are tenant-fair: one credential or workspace cannot consume another workspace's quota.

## Current Limits

| Control                       | Limit                                     |
| ----------------------------- | ----------------------------------------- |
| Credential sustained quota    | 180 cost units per minute                 |
| Credential burst              | 45 cost units                             |
| Workspace sustained quota     | 600 cost units per minute across all keys |
| Workspace burst               | 120 cost units across all keys            |
| Credential concurrency        | 10 in-flight requests                     |
| Workspace concurrency         | 40 in-flight requests                     |
| Global public API concurrency | 100 in-flight requests                    |

Listing outcomes costs 1 unit. Creating, updating, or deleting an outcome costs 5 units. Smart List configuration reads cost 2 units, configuration writes cost 5 units, member reads cost 3 units, and bounded member mutations cost 10 units. Creating a staff invitation costs 20 units to bound invitation and email-delivery abuse. Rejected credential/workspace quota decisions are atomic: Sailor does not charge one authenticated bucket when the other bucket rejects the request.

Failed authentication attempts also have an abuse limit by authoritative client IP. A non-consuming distributed precheck rejects an IP before key lookup only after earlier failed authentication exhausted that bucket. Valid keys never spend this IP budget, so unrelated customers behind the same NAT remain isolated by their credential and workspace quotas.

## Response Headers

Authenticated responses include:

| Header             | Meaning                                                      |
| ------------------ | ------------------------------------------------------------ |
| `RateLimit-Policy` | The versioned credential and workspace quota policy.         |
| `RateLimit`        | Remaining cost units and reset time for the limiting bucket. |
| `X-Request-Id`     | The request identifier to include in support reports.        |

When a quota or concurrency control rejects a request, Sailor also returns `Retry-After` in whole seconds. Header syntax follows IETF RateLimit draft 11 while the standard remains in progress; parse fields defensively rather than depending on field order.

## Retry Safely

1. Stop sending new requests for the affected key.
2. Wait at least the `Retry-After` duration.
3. Add bounded exponential backoff with jitter.
4. For writes, reuse the original `Idempotency-Key` and exact request data.
5. Cap retries and alert on sustained `429` or `503` responses.

Do not rotate keys to evade limits. All keys in a workspace share the workspace quota.