Cyndra API
Rate limits and back-off.
Every Cyndra API response tells you how much budget you have left, so an agent can pace itself instead of discovering the limit by hitting it.
Policies
What the Cyndra API allows.
| Policy | Applies to | Limit |
|---|---|---|
read | Content and discovery reads under /api/v1 | 120 / 60s |
markdown | Markdown rendering: /api/markdown, /api/md, `.md` URLs, Accept negotiation | 60 / 60s |
mcp | MCP tool calls at /mcp | 120 / 60s |
write | POST /api/v1/leads | 30 / 60s |
auth | /api/oauth/register and /api/oauth/token | 20 / 60s |
Clients are identified by bearer token when one is present, and by IP otherwise.
Headers
What comes back on every call.
Three families, because clients in the wild read different ones.
$ curl -sI https://www.cyndra.ai/api/v1/pricing
RateLimit-Policy: "read";q=120;w=60
RateLimit: "read";r=118;t=42
RateLimit-Limit: 120
RateLimit-Remaining: 118
RateLimit-Reset: 42
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118
X-RateLimit-Reset: 1787471240
Cyndra-API-Version: 1.0.0RateLimit-Reset is a delta in seconds; the X-RateLimit-Reset alias is epoch seconds, which is what clients expecting that spelling assume.
429
Backing off.
HTTP/2 429
Retry-After: 37
RateLimit-Remaining: 0
{
"error": "Rate limit exceeded: 120 requests per 60s on the \"read\" policy.",
"code": "rate_limited",
"message": "Rate limit exceeded: 120 requests per 60s on the \"read\" policy.",
"hint": "Wait 37s and retry. Limits and the Retry-After contract are documented at https://www.cyndra.ai/api-docs/rate-limits.",
"documentation_url": "https://www.cyndra.ai/api-docs",
"status": 429,
"request_id": "…"
}Counters are per server instance, so a CDN-cached read may report a slightly stale RateLimit-Remaining. Treat the 429 and its Retry-After as the authoritative signal.
FAQ
Rate limit questions.
What are the Cyndra API rate limits?
120 requests per minute for reads, 60 per minute for markdown rendering, 120 per minute for MCP tool calls, 30 per minute for writes, and 20 per minute for credential issuance. Limits are per client, identified by bearer token where there is one and by IP otherwise.
Which rate-limit headers does the Cyndra API return?
Every response under /api and /mcp carries RateLimit-Policy, RateLimit, RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, plus the X-RateLimit-* aliases. A 429 adds Retry-After.
What should an agent do when it gets a 429 from the Cyndra API?
Wait the number of seconds in Retry-After, then retry. Do not retry sooner: the window is fixed, so an early retry consumes the same budget again. Reading RateLimit-Remaining as you go avoids the 429 entirely.
Are the Cyndra API rate limits a hard global quota?
No. Counters live in each server instance, so the limit is best-effort: it protects an instance from a runaway client and gives every client an honest budget signal, but it is not a coordinated global quota. The authoritative signal is the 429 itself.