v2026.1 Open Portal ↗
On this page

Rate Limits & Errors

Rate Limits

The StackFlow API enforces rate limits at two layers: API Gateway throttling (account-wide) and per-user application-level limits.

LayerLimitScope
API Gateway burst5,000 req/sAccount-wide
API Gateway steady-state5,000 req/sAccount-wide
Standard endpoints300 req/minPer authenticated user
Write operations (POST/PATCH/DELETE)60 req/minPer authenticated user
AI endpoints60 req/minPer authenticated user
Bulk operations10 req/minPer authenticated user
Search endpoints120 req/minPer authenticated user
Service Accounts: Service accounts with the service_account role have 10x higher rate limits. Contact support to provision a service account for high-volume integrations.

Throttle Headers

Every API response includes rate limit headers so you can proactively manage your quota:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1716134460
X-RateLimit-Window: 60
Retry-After: 23  # Only present on 429 responses

HTTP Status Codes

StatusMeaningCommon Cause
200 OKSuccessGET, PATCH success
201 CreatedResource createdPOST success
204 No ContentSuccess, no bodyDELETE success
400 Bad RequestInvalid inputMissing required fields, invalid enum values
401 UnauthorizedAuthentication failedMissing/expired/invalid token
403 ForbiddenAuthorization failedInsufficient role, tenant mismatch
404 Not FoundResource does not existInvalid ID, deleted record
409 ConflictState conflictInvalid state transition, duplicate record
422 Unprocessable EntityValidation failedBusiness rule violation
429 Too Many RequestsRate limit exceededSee Retry-After header
500 Internal Server ErrorServer errorLambda error, unexpected exception
503 Service UnavailableDownstream unavailableAurora failover, Neptune timeout

Error Response Format

All error responses follow this consistent structure:

{
  "error": "Human-readable error message",
  "code": "MACHINE_READABLE_ERROR_CODE",
  "requestId": "7f3a1c2d-8e9b-4f0a-b1c2-d3e4f5a6b7c8",
  "details": {
    "field": "priority",
    "issue": "must be one of P1, P2, P3, P4"
  }
}

The requestId maps directly to the CloudWatch Logs request ID for the Lambda invocation. Include it when opening a support ticket.

Error Code Reference

CodeHTTPDescription
TOKEN_MISSING401Authorization header absent
TOKEN_EXPIRED401JWT token has expired
TOKEN_INVALID401JWT signature or format invalid
WRONG_TOKEN_TYPE403Access token used instead of ID token
INSUFFICIENT_ROLE403User role lacks required permission
TENANT_MISMATCH403Resource belongs to different tenant
RESOURCE_NOT_FOUND404Record does not exist or was deleted
VALIDATION_ERROR400Request body failed validation
INVALID_STATE_TRANSITION409State machine transition not allowed
RATE_LIMIT_EXCEEDED429Per-user rate limit reached
THROTTLED429API Gateway burst limit reached
INTERNAL_ERROR500Unexpected Lambda error
DATABASE_ERROR503Aurora or Neptune unreachable
AI_MODEL_ERROR503Bedrock API error or model throttling

Retry Strategies

Implement exponential backoff with jitter for robust API integrations:

import time
import random
import requests

def api_call_with_retry(url, headers, method="GET", body=None, max_retries=5):
    retryable_codes = {429, 500, 503}
    for attempt in range(max_retries):
        try:
            resp = requests.request(method, url, headers=headers, json=body, timeout=30)
            if resp.status_code not in retryable_codes:
                return resp
            if resp.status_code == 429:
                retry_after = int(resp.headers.get("Retry-After", 60))
                time.sleep(retry_after)
                continue
            # Exponential backoff with jitter
            wait = (2 ** attempt) + random.uniform(0, 1)
            time.sleep(min(wait, 60))
        except requests.exceptions.Timeout:
            if attempt == max_retries - 1:
                raise
            time.sleep(2 ** attempt)
    return resp
Do not retry 400/401/403/404 errors. These are client errors that will not resolve with retries. Fix the request before retrying. Only retry 429, 500, and 503 responses.