Rate limits

The real per-minute ceilings, what a 429 carries with it, and the batching that keeps a busy ingest path underneath them without dropping events.

Rate Limits

Limits are per API key and per minute unless stated otherwise. Exceeding one returns HTTP 429 with the code RATE_LIMITED and a Retry-After header in seconds. Honour that header rather than retrying on a fixed interval.

POST /v1/audit/events         600 requests / minute
GET  /v1/audit/events         120 requests / minute
POST /v1/audit/export          10 requests / minute
POST /v1/runtime/decisions   5000 requests / minute
Webhook rule create/update     20 requests / minute

Auth endpoints are limited per IP, not per key:
  login                         10 attempts / 15 minutes
  register                       3 / hour
  password reset                 3 / hour

typescript

Ingest is deliberately the loosest of these. Emitting audit events is the thing an agent under load does most, and a limit that throttles the record but not the action would leave you with a gap in the log rather than a slowed-down agent.

If you are batching, remember that one request carrying 1,000 events costs one unit against the ingest limit, not a thousand. Batching is the answer to a rate limit far more often than a higher limit is.

Need Help?

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.