Rate Limits

Authenticated responses include RateLimit-Policy and RateLimit using the pinned draft-ietf-httpapi-ratelimit-headers-11 syntax. Limits account for credential, merchant, endpoint cost, concurrency, and IP; IP is not the sole authenticated-request limiter.

A throttled request returns 429 and Retry-After. Wait for that interval, add jitter, and resume with bounded concurrency. Never turn a 429 into an immediate retry loop.