HTTP 429 Too Many Requests

You are being rate limited. The response should carry Retry-After, and usually X-RateLimit-Limit, -Remaining and -Reset.

Defined in RFC 6585 §4 — 429 Too Many Requests · MDN reference

Where you meet HTTP 429 in production

Any API with a quota — and it usually arrives all at once, when a deploy, a retry storm or a batch job pushes a normally quiet client over the line.

Why you would test it

Test that your client backs off on Retry-After rather than retrying immediately — an aggressive retry on a 429 is how a slowdown becomes an outage.

What your client should do about a 429

Honour Retry-After. If it is absent, back off exponentially with jitter — synchronised retries from many clients recreate exactly the spike the limit exists to prevent. Cap the number of attempts, and never retry a 429 in a tight loop. The X-RateLimit-Remaining and -Reset headers, where present, let you slow down before you are told to.

429 versus the codes it gets confused with

Endpoints that return 429

1 endpoint in this playground answers with 429. Every one is free, needs no signup, and can be called from the browser or with curl.

Questions about HTTP 429

What does Retry-After contain?
Either a number of seconds or an HTTP date. Both forms are valid and a client has to handle each.
Does a failed request count towards the limit?
Usually yes. Rate limits are typically counted on requests received, not on requests that succeeded.

Other client error codes

All HTTP status codes · All 39 mock REST APIs · Getting started guide

Last updated