> ## Documentation Index
> Fetch the complete documentation index at: https://supahooks.ar27111994.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limiting for API and webhook ingest endpoints

> Rate limiting in Webhook Debugger & Logger: per-IP limits on management endpoints and a separate per-webhook limiter for high-throughput ingest traffic.

The server applies two independent rate limiters: one for management and probe endpoints, and a separate per-webhook limiter for ingest traffic. Both limiters return standard HTTP throttling responses with headers that tell you when you can retry.

## Management endpoints

The `rateLimitPerMinute` setting in Actor input controls the per-IP request limit applied to all management and probe routes:

* `GET /`
* `GET /info`
* `GET /logs`
* `GET /logs/:logId`
* `GET /logs/:logId/payload`
* `GET /log-stream`
* `POST /replay/:webhookId/:itemId`
* `GET /system/metrics`
* `GET /health`
* `GET /ready`

Each unique client IP gets its own counter. The window resets every 60 seconds.

## Webhook ingest

`ANY /webhook/:id` uses a **separate per-webhook limiter** that is tuned for higher throughput. The default ceiling is **10,000 requests per minute per webhook**. When the limit trips, the route returns a `429` with a webhook-specific error body.

This limiter is intentionally independent from `rateLimitPerMinute` so that high-volume webhook traffic does not consume your management API quota.

## Rate limit response headers

Both limiters attach the following headers to every response:

| Header                  | Description                                                  |
| ----------------------- | ------------------------------------------------------------ |
| `X-RateLimit-Limit`     | Maximum requests allowed in the current window               |
| `X-RateLimit-Remaining` | Remaining requests in the current window                     |
| `X-RateLimit-Reset`     | Unix timestamp when the current window resets                |
| `Retry-After`           | Seconds to wait before retrying (present on `429` responses) |

## 429 response bodies

The shape of the `429` error body depends on which limiter triggered.

**Management route `429`:**

```json theme={null}
{
  "status": 429,
  "error": "Too Many Requests",
  "message": "Rate limit exceeded. Max 60 requests per 60s."
}
```

**Webhook ingest `429`:**

```json theme={null}
{
  "status": 429,
  "error": "Too Many Requests",
  "message": "Webhook rate limit exceeded. Max 10000 requests per minute per webhook.",
  "retryAfterSeconds": 60
}
```

The webhook ingest body includes `retryAfterSeconds` as a convenience field alongside the standard `Retry-After` header.