# Rate Limits

HTTP requests are rate-limited per **IP** (anonymous) or per **client account** (authenticated). All API keys belonging to the same account consume one shared per-minute allowance. Daily and monthly free quotas count submitted validation entries, with duplicates removed within each bulk request.

## Limits by tier

| Tier | Request rate | Validation quota |
| --- | --- | --- |
| Anonymous | 30/min per IP | 1,000/day per IP |
| Free (account) | 60/min per account | 10,000/day, 30,000/month |
| Starter | 120/min per account | No monthly cap |
| Pro | 500/min per account | No monthly cap |

Brand-new free accounts ramp up: for the first 24 hours they are capped at 10 requests/min and 1,000 validations/day before settling at the full free limits.

A single-email or single-domain check consumes one validation unit. A bulk request consumes one validation unit per unique submitted address; duplicate entries in the same batch are counted once. Viewing an existing bulk result does not consume validation quota.

See [Authentication](https://docs.disify.com/guide/authentication.md) for how tiers map to features and bulk limits.

## Response headers

Responses normally carry these headers. Early failures and requests covered by overflow credits may omit them.

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | Your per-minute limit |
| `X-RateLimit-Remaining` | Requests remaining in the current window |

## When you exceed the limit

- Exceeding the limit returns **`429 Too Many Requests`**.
- Sustained abusive traffic may result in an automatic IP ban.
- For per-minute limits, wait for `Retry-After` / `retry_after`. For daily or monthly quota exhaustion, use `reset_at`; repeated retries will not restore quota. See [Error Handling](https://docs.disify.com/api/errors.md).
- If your account holds [credits](https://docs.disify.com/guide/credits.md), a burst over the limit spends a credit instead of failing (flagged by the `X-Credit-Used` response header).

## Best practices

- **Batch large lists.** [Bulk validation](https://docs.disify.com/api/bulk.md) reduces HTTP requests, but still consumes one validation unit per unique entry.
- **Cache carefully.** Set an expiry and keep domain and individual email results separate. See [Best Practices](https://docs.disify.com/resources/best-practices.md#cache-and-batch-deliberately).

Source: https://docs.disify.com/guide/rate-limits.html