Usage and rate limits.
Two controls apply: a per-minute token bucket on each API key, and monthly quotas on your organization's plan. Both are shared by REST and MCP, and both are visible to you in headers and usage events.
Token bucket per API key
One token is taken per HTTP request, REST or MCP. Values as configured today; your dashboard shows the limits in force for your organization, and enterprise agreements can set different values.
| Plan | Requests per minute |
|---|---|
| Free | 60 |
| Pro ($149/mo) | 300 |
| Business ($799/mo) | 1,200 |
| Enterprise | 3,000, or as agreed |
Plan quotas per organization
Counted from the 1st of each month (UTC) per channel. Demo records count toward quotas but are never charged.
| Plan | API requests | MCP calls | Downloads | Dataset tiers |
|---|---|---|---|---|
| Free | 1,000 | 100 | 10 | free, standard |
| Pro | 50,000 | 5,000 | 250 | free, standard, premium |
| Business | 500,000 | 50,000 | 2,500 | free, standard, premium |
| Enterprise | By contract | By contract | By contract | All, including enterprise and contact |
What every response tells you
| Header | Meaning |
|---|---|
| X-RateLimit-Limit | Bucket capacity for this key. |
| X-RateLimit-Remaining | Tokens left in the bucket. |
| X-RateLimit-Reset | Seconds until the bucket is full again. |
| Retry-After | On a 429, seconds to wait before retrying. |
| X-Request-Id | Unique id for the request; also the metering key. Quote it in support tickets. |
What counts as usage
Exactly one usage event is written per billable successful request, keyed by the server request id, so retries of the same request cannot be double-counted. Billable means record search, record fetch, citation resolution when served, and downloads. Catalog, schema, provider, jurisdiction and usage reads are not metered, and neither are failed calls. Each MCP tool call gets its own request id and usage event on the mcp channel.
Metering fails closed: if the usage event cannot be written, no data is returned. Each event records the license terms that applied when the data was served. Demo events are recorded at zero cost and marked waived.
Provider limits also apply: page sizes are capped at 100 records, and LAW.co's current keyword search returns a random sample of at most 50 results, flagged in meta.warnings.
Rate limited versus quota exceeded
Both return HTTP 429. rate_limited clears within a minute; quota_exceeded lasts until the monthly reset or a plan change. Check the code before retrying.
{
"data": null,
"meta": { "request_id": "req_…", "api_version": "v1", "demo": false },
"error": {
"type": "rate_limit_error",
"code": "rate_limited",
"message": "Rate limit exceeded. Retry after the time in Retry-After.",
"param": null,
"request_id": "req_…"
}
}Illustrative example · final API surface documented in /docs
Staying within limits
- Honor Retry-After on 429
- Use cursors, not repeated full scans
- Cache catalog metadata — it changes rarely and is not metered
- Use separate keys per workload to isolate per-minute limits
- Monitor with usage:read
- Subscribe to the usage.threshold_reached webhook for 80% and 100% alerts
Sizing a workload against your plan
- 1
Count billable calls
Estimate searches, record fetches and downloads per month. Catalog and schema reads are free of quota, so cache them and do not count them.
- 2
Split by channel
API requests and MCP calls have separate monthly quotas. An agent that calls three tools per question uses three MCP calls.
- 3
Check peaks
Compare your busiest minute against the per-key bucket. Batch jobs should pace themselves below it rather than relying on 429s.
- 4
Leave headroom
Retries of failed requests consume per-minute tokens. Plan for some failure rate and set a usage.threshold_reached alert.
Pacing long-running work
For backfills and scheduled jobs, read X-RateLimit-Remaining and X-RateLimit-Reset on each response and slow down before the bucket empties, rather than running at full speed until a 429 arrives. Run batch work on its own key so it cannot starve interactive traffic, and stop the job cleanly on quota_exceeded instead of retrying until the month resets.
Questions buyers ask
Are per-minute limits per key or per organization?
Per key. Monthly quotas are per organization. Splitting work across keys isolates bursts, but every key draws from the same monthly quota.
Can limits be raised?
Business and Enterprise plans are designed for higher limits; contact us with your expected volume. Staff can set per-organization overrides.
Do failed requests count?
They take a token from the per-minute bucket, because the bucket is checked early, but they are not metered and do not count toward monthly quotas.
Are customer prices per request published?
Not yet. Per-request prices are zero by default until pricing is agreed with providers. Plan prices are Pro at $149/month and Business at $799/month.
Do catalog reads count against quotas?
No. Dataset lists, descriptors, schemas, providers, jurisdictions and usage reads are not metered. They still take a token from the per-minute bucket.
When do monthly quotas reset?
At the start of each calendar month in UTC. Usage is counted per organization and per channel from the 1st.
API and MCP access is live.
Sign up at app.data.co, create an organization and issue a scoped key for REST and MCP.