Rate Limits - Worm

Worm applies per-scope throttling to protect API reliability.

Scopes

Scope	Limit	Applies To
`api_public`	`120/min`	Public endpoints
`api_authenticated`	`300/min`	Authenticated endpoints
`api_auth_bootstrap`	`10/min`	Key bootstrap endpoints (`challenge`, `create`)

Rate Limit Headers

Responses include:

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed in the current window
`X-RateLimit-Remaining`	Requests remaining in the current window
`X-RateLimit-Reset`	Unix timestamp when the window resets

429 behavior

When a request is throttled, the API returns 429 with the standard error envelope:

429

{
  "data": null,
  "meta": null,
  "error": {
    "code": -17,
    "slug": "throttled",
    "message": "Request was throttled. Expected available in 12 seconds.",
    "details": []
  }
}

Retry Strategy

When you receive 429:

Prefer the Retry-After response header (seconds until retry) when present.
Otherwise use X-RateLimit-Reset to determine when the window resets.
Add jittered exponential backoff for bursts.
Cache repeated reads and avoid polling tight loops.