Limits
Generous ceilings that exist to stop runaway loops, not to throttle normal use. A healthy fleet should never see one.
Request limits
Requests are counted in fixed one-minute windows. Robot calls are counted per robot, so one misbehaving machine cannot starve the rest of your fleet, and dashboard calls are counted per account.
| Field | Type | Description |
|---|---|---|
| robot API | 600 / min | Any authenticated call with a robot API key — claiming, completing, telemetry, events. Ten per second, sustained. |
| dashboard | 300 / min | Mutations made from the dashboard, per signed-in account. |
| sign-in | 60 / min | Challenge requests per wallet address, since the endpoint is deliberately unauthenticated. |
Telemetry accepts up to 50 samples per request, so the robot limit allows 30,000 samples a minute without batching harder.
When you go over
The response is 429 with a Retry-After header and the seconds left in the window. Nothing is lost: a task you could not complete stays claimed, so retrying after the delay picks up exactly where you were.
{
"error": "rate_limited",
"message": "Too many requests: 600 per minute is the ceiling. Retry in 24s. See https://hoodly.fun/docs/limits",
"retry_after": 24
}Every response also carries X-RateLimit-Limit and X-RateLimit-Remaining, so a client can back off before it is refused.
Account ceilings
Rate limits slow a loop down; these stop it. An account can hold at most 500 robots and 100 fleets. Reaching either returns 409 — delete what you are not using, or get in touch and we will raise it.
There is no cap on tasks or telemetry rows. Those are metered by the anchor quota instead, which is a better fit: what costs us money is anchoring, not storage.
What is never limited
The public verification endpoint, GET /api/v1/verify/:hash, is neither rate limited nor metered. Proof checking has to stay free and unconditional, otherwise a receipt would only be as trustworthy as your relationship with us.
Why the limits exist at all
Most write paths cost no gas: registering a robot, claiming a task, posting telemetry. Rate limits and account ceilings close the gap that used to sit in front of those paths, without getting in the way of real fleets. Anchoring itself is metered by prepaid credits.
Counters live in Postgres rather than in memory, because serverless instances do not share memory and a per-instance counter would let a caller multiply its allowance by however many instances happen to be warm.