Rate limits
REST and MCP share request limits. In the table below, an API client is the OAuth application that sends requests.
| Limit | Per | Covers |
|---|---|---|
| 120 requests per rolling minute | API client | All other reads |
| 60 requests per rolling minute | API client | Computation catalog and contracts, batch and rollover execution, and scenario computations |
| 30 requests per rolling minute | API client | Writes and export job creation, including replays of the same Idempotency-Key |
| 10 requests per rolling minute | API client | Portal comments and invitation deliveries, integration sync applies, and export artifact deliveries, instead of the write limit |
| 240 requests per rolling minute | Principal, MCP only | Every MCP request after the bearer token is verified, including initialize, tool and resource listing, and notifications |
| 30 attempts per rolling minute | Verified API client across all source IPs, or user and workspace for delegated grants | Token requests |
| 90 requests per rolling minute | Source IP | Pre-authentication work on REST and the OAuth endpoints, plus rejected MCP authentication attempts |
| 500 requests per five minutes | Source IP | All traffic |
Delegated connections share their user's read, computation and write allowances within the workspace, including across different hosts.
For published IP ranges of interactive AI hosts, the source-IP limits are 1,000 requests per minute for pre-authentication work and 5,000 per five minutes for all traffic. REST and OAuth endpoints also enforce 240 requests per minute per bearer token across all source IPs.
Reaching a limit returns 429. The token endpoint uses the OAuth error temporarily_unavailable, and the MCP transport returns {"error": "rate_limit_exceeded"}. When a read or computation limit is reached during an MCP tool call, the tool result contains an error with retry guidance.