Platform limits
The 5.5 MB request and response cap, plan rate limits, and the status codes every API returns.
These limits apply to every organisation. Meter windows are separate. Those are configured per meter on Meter limits.
Payload size
Request bodies and response payloads are limited to 5.5 MB. The check leaves room for headers. Binary content counts toward the same limit.
A response over 5.5 MB returns 413 with requestrocket-proxy-code: response-too-large. A request body over 5.5 MB is rejected.
Rate limits
RequestRocket may apply a rate limit for the plan. The proxy limit is per organisation. The Core API limit is per user. When a limit is exceeded the response is 429 Too Many Requests. A meter-limit response includes Retry-After in seconds. Wait at least that long before retrying.
Status codes
| Code | Meaning | What to do |
|---|---|---|
| 200 | Success | Continue with the response. |
| 400 | The body or query is invalid, or proxy policy denied the request | Correct the named field, or inspect the applicable rules and default effects. |
| 401 | An inbound credential was rejected, or the Core API Authorization header is missing | Send the required credential. Do not use a user token when calling a proxy. |
| 402 | The organisation is suspended for billing | Resolve the organisation's billing state before retrying. |
| 403 | The role or plan cannot perform the operation, or the Core API rejected the user token | Check the membership role, plan feature, or user token. |
| 404 | The resource does not exist | Check the path and resource id. |
| 413 | The request body or response payload is over 5.5 MB | Send or request a smaller payload. |
| 429 | A plan rate limit or a meter window was exceeded | For a meter limit, wait for the number of seconds in Retry-After. Otherwise reduce the request rate. |
| 500 | RequestRocket failed | Retry the request. Contact support if it continues. |
| 502 | The target failed or could not be reached | Check the target URL and target availability before retrying. |
| 504 | The target did not answer in time | Check target latency, then retry only when it is safe to repeat the operation. |
On the Core API, a missing Authorization header returns 401. A user token that is unknown, expired, or not valid returns 403. See Authentication with the API.
Gateway responses also set requestrocket-proxy-code. proxy-access-granted means the inbound credential was accepted and the status came from the target or from a later policy. proxy-access-denied, billing-suspended, feature-gated, rate-limited, response-too-large, transform-abort, and transform-error are RequestRocket.