Rate limits

Limits are enforced per API key at the gateway, by plan. Every RPC response carries live counters so your client can pace itself without guessing.

Plans

Plan	Requests/min	Requests/hour	Requests/day	CU price (USD)
free	10	500	10,000	$0
standard	50	2,500	50,000	$0.001
premium	100	5,000	100,000	$0.0005
enterprise	1,000	50,000	1,000,000	$0.0002

Live source of truth (no auth required beyond a key):

curl https://api.lab.au.ro/api/v1/plans

[
  {"tier":"free","per_minute":10,"per_hour":500,"per_day":10000,"price_per_cu":0},
  {"tier":"standard","per_minute":50,"per_hour":2500,"per_day":50000,"price_per_cu":0.001},
  {"tier":"premium","per_minute":100,"per_hour":5000,"per_day":100000,"price_per_cu":0.0005},
  {"tier":"enterprise","per_minute":1000,"per_hour":50000,"per_day":1000000,"price_per_cu":0.0002}
]

Response headers

Every gateway response includes the current window state:

x-ratelimit-limit-minute: 1000
x-ratelimit-remaining-minute: 998
x-ratelimit-limit-hour: 50000
x-ratelimit-remaining-hour: 49998
x-ratelimit-limit-day: 1000000
x-ratelimit-remaining-day: 999998
ratelimit-limit: 1000
ratelimit-remaining: 998
ratelimit-reset: 23

ratelimit-reset is seconds until the tightest window resets.

When you exceed a limit — HTTP 429

{"message":"API rate limit exceeded"}

with a Retry-After: <seconds> header. Honor it — see Batches, retries & caching for a ready-made backoff snippet.

Heavy-method guard (Ethereum)

Expensive scan methods are additionally limited to 1 request/min per key on /eth, independent of plan:

• eth_getLogs, eth_getFilterLogs

// HTTP 429
{"message":"Heavy method rate limit: 1/min for eth_getLogs"}

debug_* methods are not available at all (HTTP 403, {"error":"debug methods not permitted"}).

Daily Compute-Unit quota

Independent of request-rate limits, each project has a daily CU budget (default 100,000 CU/day). Exhausting it returns JSON-RPC error -32005 (compute unit quota exceeded) on HTTP 200 — see Compute Units.

Suspended accounts — HTTP 402

If your tenant is suspended (e.g. unpaid invoices), every RPC request returns HTTP 402:

{"message":"account suspended — contact your administrator"}

Keys are preserved; service resumes the moment the account is reactivated.