Rate limits and quotas

The ServerOps API enforces two separate constraints: rate limits (how many requests per second/minute) and quotas (cumulative usage against your plan).

Rate limits

Rate limits are per API token:

Both limits apply simultaneously. Exceeding either returns 429 Too Many Requests with code rate_limited.

Rate limit headers

Every response includes headers so you can monitor your usage before hitting the limit:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 847
X-RateLimit-Reset: 1716825600

• X-RateLimit-Remaining: requests left in the current window
• X-RateLimit-Reset: Unix timestamp when the window resets

Plan quotas

Quotas are cumulative limits that reset on your billing cycle. What they cover depends on your plan:

When a quota is exceeded the API returns 429 with code quota_exceeded and a snapshot showing all current metrics. See Error handling for the full response shape.

Backoff strategy

Rate limit backoff

For rate_limited responses, use exponential backoff with jitter:

-- FiveM Lua example
local function RequestWithRetry(url, method, body, headers, maxRetries)
    local attempt = 0
    local function attempt()
        PerformHttpRequest(url, function(code, responseBody)
            if code == 429 and attempt < maxRetries then
                attempt = attempt + 1
                local delay = math.pow(2, attempt) + math.random() -- jitter
                SetTimeout(delay * 1000, attempt)
            elseif code == 200 or code == 201 then
                -- success
            else
                print("Request failed: " .. code)
            end
        end, method, body, headers)
    end
    attempt()
end

Quota backoff

Do not retry quota errors. Instead:

1. Log the error with the full snapshot for your records.
2. Alert your team (Discord webhook, email, etc.).
3. Either upgrade your plan or reduce your usage until the quota resets.

High-volume tips

If you are sending a lot of requests (for example, logging every player event on a 200-player server), batch where possible:

• Logs: buffer events for 5-10 seconds and send them in a single request if the API adds batch support. For now, send individually but spread them over time rather than all at once.
• Media: only upload files when needed (on ban, report, or explicit staff action). Avoid uploading on every player action.
• Per-token limits: if you run multiple servers, use a separate token per server so their rate limits are independent.