Rate limits

Limits protect the service for everyone. They are generous for normal integration traffic and only bite under bursts or loops.

Windows

How limits are applied

Limits are applied per account over a rolling window.

Surface	Window	Notes
Public API endpoints	15 minutes	Covers /v1 record and account endpoints
AI chat	1 minute	POST /v1/chat is metered more tightly because each call costs AI usage
Authentication	15 minutes	Sign-in attempts, applied per account and per address

Exact allowances depend on your plan. Your dashboard usage panel is the authoritative view of where you stand.

Exceeding

What happens at the limit

You receive HTTP 429. Nothing is created, and the request can be safely retried later.

# Exponential backoff with jitter
attempt=0
until [ $attempt -ge 5 ]; do
  code=$(curl -s -o /tmp/r.json -w '%{http_code}' \
    -H "X-SIMCOAI-API-Key: $SIMCOAI_API_KEY" "https://api.simcoai.co.uk/v1/orders")
  [ "$code" != "429" ] && break
  attempt=$((attempt+1))
  sleep $(( (2 ** attempt) + (RANDOM % 3) ))
done

Avoiding

Staying well under

Batch instead of polling per record. One list call beats fifty single fetches.
Use webhooks rather than polling. Let SIMCOAI tell you when something changes.
Cache /v1/me. Scopes rarely change; there is no need to call it per request.
Put a ceiling on retries. An unbounded retry loop is the usual cause of a sustained 429.