Rate Limits

Rate limits are protective throttles, not billing tiers -- Creed Space does not charge per call.

Default Limits

An API key carries no rate limit of its own unless one is set on it. When no per-key limit is configured, only the per-route limit applies — for POST /api/v1/safety/evaluate that is 100 requests/minute, and there is no daily cap.

A daily cap applies only when rate_limit_rpd is set on the key. Individual keys can carry custom per-minute and per-day limits (see Per-Key Limits below).

Rate Limit Headers

Every API response includes rate limit information:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1704067200

Header	Description
X-RateLimit-Limit	Maximum requests per minute
X-RateLimit-Remaining	Requests remaining in current window
X-RateLimit-Reset	Unix timestamp when limit resets
X-RateLimit-Burst-Remaining	Requests remaining in the short burst window
X-RateLimit-Limit-Day	Daily request cap — only present when a daily limit is set on the key
X-RateLimit-Remaining-Day	Requests remaining today — only present with a daily limit
X-RateLimit-Reset-Day	Unix timestamp when the daily window resets — only present with a daily limit

Handling Rate Limits

A 429 response means you hit the limit:

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Please try again later.",
  "retry_after": 30
}

This is the body for a key over its per-key limit. The per-IP limit that runs before authentication returns {"error": {"type": "rate_limit_exceeded", "message": "Rate limit exceeded. Too many requests. Please try again later.", "retry_after": 30}, "detail": "Rate limit exceeded"}. Both carry a Retry-After header, so branch on the 429 status and read that header rather than parsing the body.

The response includes:

• A Retry-After header with the number of seconds to wait before retrying

Best Practices

Wait for the number of seconds in Retry-After, then retry. With the REST API (Safety Evaluation and PDP Adjudication have no SDK wrapper):

import time

import httpx

http = httpx.Client(
    base_url="https://api.creed.space",
    headers={"X-API-Key": "cs_live_..."},
    timeout=30.0,
)


def evaluate_with_retry(text: str, max_retries: int = 3) -> dict:
    for attempt in range(max_retries):
        response = http.post("/api/v1/safety/evaluate", json={"input_text": text})
        if response.status_code == 429 and attempt < max_retries - 1:
            time.sleep(int(response.headers.get("Retry-After", "1")))
            continue
        response.raise_for_status()
        return response.json()["evaluation"]
    raise ValueError("max_retries must be at least 1")

The Python SDK does not retry for you. It raises creed_sdk.errors.RateLimitError, whose retry_after holds the Retry-After value in seconds, or None when the header is missing.

Exponential Backoff

For production systems, implement exponential backoff with jitter, and honour Retry-After when it is longer:

import random
import time


def evaluate_with_backoff(text: str, max_retries: int = 5) -> dict:
    base_delay = 1
    max_delay = 60

    for attempt in range(max_retries):
        response = http.post("/api/v1/safety/evaluate", json={"input_text": text})
        if response.status_code == 429 and attempt < max_retries - 1:
            delay = min(base_delay * (2 ** attempt), max_delay)
            retry_after = int(response.headers.get("Retry-After", "0"))
            time.sleep(max(delay + random.uniform(0, delay * 0.1), retry_after))
            continue
        response.raise_for_status()
        return response.json()["evaluation"]
    raise ValueError("max_retries must be at least 1")

Per-Key Limits

API keys can have custom rate limits set during creation. Both are optional; leaving one unset means that dimension is not capped at the key level:

• rate_limit_rpm - Custom requests per minute (unset: the per-route limit applies)
• rate_limit_rpd - Custom requests per day (unset: no daily cap, and the -Day headers are omitted)

View your key's limits in the Dashboard.

Increasing Limits

Set custom per-key limits when creating a key in the Dashboard. To raise your account's default limits, contact us.

Monitoring Usage

Track your usage in real-time:

1. Dashboard → Usage - Visual analytics
2. Per-key usage in Dashboard → API Keys
3. Rate limit headers in every response