Per-Minute Rate Limit
Each API key is limited to 100 requests per minute using a fixed-window counter. The window resets every 60 seconds.Monthly Credits
Every API key has a monthly credit allowance that varies by plan. UseGET /v1/usage to check your current request counts and remaining budget.
Some endpoints are available only on higher plans. In particular:
- Core lookup and monitoring endpoints are available broadly
- Brief endpoints require a higher plan
- Bulk feed and webhook endpoints are limited to higher-tier plans
Response Headers
Every response includes rate limit and credit headers:Access Layers
Shoal’s pricing and access model is intentionally tied to route type, not just raw request count:evaluationroutes are the safest entry points for new integrationsoperationalroutes are higher-value workflow surfacespremiumroutes expose bulk feed or delivery capabilities and are more tightly gated
evaluation:/v1/search,/v1/entities/byName,/v1/signal/topoperational:/v1/brief,/v1/brief/batch,/v1/webhooks/*premium:/v1/radar/all,/v1/signal/all,/v1/organizations/all,/v1/replay/global
/v1/organizations/allis an export-style directory surface with smaller page sizes/v1/radar/alland/v1/signal/allare recent-monitoring surfaces with a requiredsincewindow and tighter pagination caps/v1/replay/globalis a merged premium replay surface with a 30-day recent-history window and smaller pages
/v1/webhooks/*is a scoped delivery primitive forradarandsignalsubscriptions- premium/global delivery should be treated as a separate product surface if added later
Exceeding Limits
Per-Minute Rate Limit
- Status:
429 Too Many Requests - Check
X-RateLimit-Resetheader for seconds until the window resets
Monthly Credit Limit
- Status:
403 Forbidden - Check
X-Monthly-LimitandX-Monthly-Usedheaders for your quota status - Credits reset on the 1st of each month (UTC)
Best Practices
- Use the
sinceparameter to poll incrementally instead of re-fetching everything - Prefer filtered endpoints over bulk feeds unless you explicitly need a full export workflow
- Use
X-Api-SurfaceandX-Access-Layerto verify you are hitting the route class you intended - Check
X-RateLimit-Remainingbefore sending bursts - Monitor
X-Monthly-Remainingto avoid hitting your credit cap - Use the
/v1/usageendpoint to track both request volume and monthly budget - On
429, wait for theX-RateLimit-Resetduration before retrying - Implement exponential backoff on non-2xx responses