---
title: "Rate limits & quotas — GanttFather API"
description: "Per-token burst limit, daily quota, per-IP safety net, caching, and idempotent retries."
canonical: "https://ganttfather.com/docs/api/rate-limits/"
locale: "en"
category: "product"
---

# Rate limits & quotas — GanttFather API

API reference [AI assistants (MCP)](https://ganttfather.com/docs/ai-agent/)

## Getting started

- [Introduction](https://ganttfather.com/docs/api/introduction/)
- [Authentication](https://ganttfather.com/docs/api/authentication/)
- [Pagination](https://ganttfather.com/docs/api/pagination/)
- [Rate limits & quotas](https://ganttfather.com/docs/api/rate-limits/)
- [Errors](https://ganttfather.com/docs/api/errors/)

## Projects

- [GET List projects](https://ganttfather.com/docs/api/list-projects/)
- [GET Get project](https://ganttfather.com/docs/api/get-project/)

## Tasks

- [GET List tasks](https://ganttfather.com/docs/api/list-tasks/)
- [GET Get task](https://ganttfather.com/docs/api/get-task/)
- [POST Create task](https://ganttfather.com/docs/api/create-task/)
- [PATCH Update task](https://ganttfather.com/docs/api/update-task/)
- [DELETE Delete task](https://ganttfather.com/docs/api/delete-task/)
- [POST Reorder tasks](https://ganttfather.com/docs/api/reorder-tasks/)
- [PUT Set assignees](https://ganttfather.com/docs/api/set-assignees/)

## Dependencies

- [GET List dependencies](https://ganttfather.com/docs/api/list-dependencies/)
- [PUT Set dependencies](https://ganttfather.com/docs/api/set-dependencies/)
- [POST Add dependency](https://ganttfather.com/docs/api/add-dependency/)
- [DELETE Remove dependency](https://ganttfather.com/docs/api/remove-dependency/)

## Resources

- [GET List resources](https://ganttfather.com/docs/api/list-resources/)
- [POST Create resource](https://ganttfather.com/docs/api/create-resource/)
- [PATCH Update resource](https://ganttfather.com/docs/api/update-resource/)
- [DELETE Delete resource](https://ganttfather.com/docs/api/delete-resource/)

## Members

- [GET List members](https://ganttfather.com/docs/api/list-members/)

 Getting started / **Rate limits & quotas**

# Rate limits & quotas

 Updated Jul 4, 2026

 Two per-token bounds, plus one per-IP safety net:

## Burst limit

 **60 requests/minute per token.** Exceeding it returns 429 (code rate_limited ) with Retry-After: 60 .

## Daily quota

 **5,000 requests per day per token.** Every counted response carries X-Quota-Limit and X-Quota-Remaining ; exceeding it returns 429 (code quota_exceeded ) with Retry-After set to the daily reset. GET /v1/health is never counted.

 Pace long jobs off X-Quota-Remaining rather than retrying into the wall.

## Per-IP fallback

 An additional **300 requests/minute per client IP** guards against floods. If you run several tokens from one server, they share this IP budget — space them out or spread across IPs to stay clear of it.

## Caching

 Heavy GETs (project, task list) return a strong ETag . Send it back as If-None-Match and an unchanged resource answers 304 Not Modified with an empty body — poll cheaply that way. Cross-origin JavaScript can read ETag , X-Total-Count , X-Trace-Id , and Retry-After (CORS-exposed).

## Idempotent creates

 POST endpoints that create things accept an Idempotency-Key header. Retrying with the **same key and same body** replays the original response — no duplicate is created. The same key with a **different body** is 409 idempotency_conflict . Keys are scoped to your token and project.

 One caveat: a replay returns the **cached original response**, not a live re-read — if the resource changed or was deleted since, the replay still echoes its creation snapshot. Use a fresh key per logical create; reuse a key only to retry the identical request.

## Best practices

- **Back off on 429 ** rather than retrying immediately — honor the Retry-After header, whether the limiting bound was the burst limit or the daily quota.

- **Check the code field** on a 429 ( rate_limited vs quota_exceeded ) to tell a short burst apart from a day you need to pace differently.

- **Watch X-Quota-Remaining ** on every response and slow down before you hit zero, instead of discovering the wall by getting 429 s.