Rate limits

Each credential has its own budget per 60-second window. The response headers say how much is left.

The budget#

Each credential has its own limit, counted in fixed 60-second windows.
The default is 300 requests a minute. A key can carry its own limit.
The budget is yours alone. The clinic's own use of Claro never spends it, and your sync never spends theirs.

Every response that gets past the credential and scope checks carries them, including 400 and 404 errors.

RateLimit-Limit: 300
RateLimit-Remaining: 287
RateLimit-Reset: 41
RateLimit-Policy: 300;w=60

Header	Meaning
`RateLimit-Limit`	Requests allowed in the window
`RateLimit-Remaining`	Requests left in this window
`RateLimit-Reset`	Seconds until the window resets
`RateLimit-Policy`	The limit and the window, in seconds

The response is 429, with Retry-After in seconds:

HTTP/1.1 429 Too Many Requests
Retry-After: 41
RateLimit-Remaining: 0

{"error": {"type": "rate_limit_error", "code": "rate_limited", ...}}

Wait that long, then carry on. Retrying sooner only earns another 429.