← SkillSafe
Limit Ladder

For teams that publish an API with limits

Limit LadderCheck your rate-limit policy, so integrators can predict and observe throttling instead of tripping over it.

List your tiers and paste one throttled response. Your browser normalises every rate, catches burst equal to sustained, works out each bucket's refill time and the per-region multiplier, diffs documented against enforced, and reads the response: 429 or a throttle inside 200, Retry-After in seconds or an HTTP-date, legacy or IETF headers, the reset semantics. It checks fairness, overrides and change notice, ranks the algorithm and header family, and writes your limits table and an example 429. Then the published policy, and the rollout.

Try a sample:

The API, and a short interview free

Tiers, carve-outs and what is enforced free

Algorithm, headers and one throttle response free

Overrides and change free

The checks free

What the page flags

Every tier, normalised

The throttle response, read

Area by area

Your limits table and an example 429 free

The table integrators capacity-plan against, and a throttle response in the ranked header family. The IETF policy field expresses the bucket as quota per refill window.

Limits table (Markdown)


    

Example 429


    

The published policy

Pricing as soon as the session is ready...

NOT RUN YET

The page's check of this reply

    Saved policies

    How it works - and what is sourced

    The checks follow the skill: one metering model per paradigm (requests for REST, cost points with a published formula for GraphQL); an algorithm whose behaviour matches its name (a token bucket banks idle time as burst, a leaky bucket does not); burst and sustained as two numbers, keyed deliberately and scoped global or per region (per-region enforcement multiplies real throughput by the region count); documented limits equal to enforced ones; a documented secondary guard; fairness layers; the legacy header trio by default, both families when the edge emits the IETF fields, never the IETF fields alone; 429 with Retry-After in delay-seconds, never cached, never a throttle inside 200; a named override path keyed to a principal; at least six weeks' notice before a limit is lowered. Rates are normalised to requests (or points) per second; refill time is burst divided by that rate.

    The rankings follow the skill: token bucket by default, sliding window under abuse, leaky bucket for a fragile downstream, fixed window only for internal limits, and whatever the gateway enforces under a hard date; legacy headers by default, both families when the edge emits the IETF fields cheaply, no headers only as a deliberate posture with retrying SDKs; fairness layers deferred under a low effort ceiling.