Rate limits

Dockt applies approximate abuse-protection limits per authenticated principal:

Request group	Limit
Reads	1,000 requests per 60 seconds
Writes	200 requests per 60 seconds
Assessment document uploads	20 requests per 60 seconds

These limits are request protection, not contracted product quotas.

Handle a rate-limit response

When a limit is exceeded, Dockt returns 429 Too Many Requests with an application/problem+json body and a Retry-After header in seconds.

1. Stop sending requests in the affected workflow.
2. Wait for Retry-After.
3. Add random jitter when multiple workers may retry together.
4. Retry with the original idempotency key when the operation supports idempotency.
5. Reduce polling frequency or use webhooks for asynchronous completion.

Don’t retry a 429 immediately. Coordinated immediate retries extend congestion and can delay recovery.

Reduce request volume

• Use assessment.completed, document.completed, and document.failed webhooks.
• Cache stable catalog and configuration reads when appropriate for your application.
• Use collection filters and a larger limit instead of many small page requests.
• Avoid polling several views for the same resource state.