Rate limiting
Each APEX key has a per-minute request budget enforced in a fixed one-minute window. Responses carry the budget state in X-RateLimit headers; exceeding it returns 429 with Retry-After.
Each APEX key has a per-minute request budget, enforced with a fixed one-minute window. This is the APEX-specific limiter; the header conventions match the rest of the platform (see API conventions).
The budget
| Setting | Value |
|---|---|
| Per-key budget | The key's configured per-minute limit (default 60). |
| Fallback when unset | The service default (120). |
| Window | Fixed 60 s from the first request in the window. |
| Scope | Per API instance — with N instances the effective ceiling is up to N× the configured limit. |
Headers
Every authenticated response carries the budget state:
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 44
X-RateLimit-Reset: 1780735096When you exceed it
Exceeding the budget returns 429 with a Retry-After header (seconds until the window
resets) and the code RATE_LIMITED:
{
"error": "rate limit exceeded",
"code": "RATE_LIMITED",
"message": "request budget for this API key is exhausted; retry after the window resets"
}Rate-limited requests are still counted in per-key usage statistics, so operators can see who is hitting their budget. For high-volume workloads, prefer the batch estimate endpoint (up to 500 lanes in one call) over many single requests.
Authentication
APEX authenticates every request with an X-API-Key header. Keys are hashed at rest, returned once at creation, and validated on each request; a validation failure denies access rather than erroring.
Price estimation
POST /estimate returns a lane's market price as p25/median/p75 with a confidence score, resolved through a four-level cascade. Confidence is computed from data volume and freshness, scaled by the cascade level.