Rate limits

The scanner API at https://scanner.varnir.site/api/* has fair-use limits. They are there to stop bursts and floods, not to meter normal use: payments and trades on the ledger cost 0 credits, but running the API still costs something.

What you get when you hit one

429 Too Many Requests, with a Retry-After: 60 header and a JSON body with an error message. For the general /api limits below it is:

{"error": "Too many requests. Wait a minute and try again."}

The route-specific limits word their message for the route. Wait for the Retry-After period, then retry; the refused request was not applied.

The limits

Every limit is requests per minute.

Per IP address, on every public /api route:

Caller	Limit
No signature header	120
Carries an X-Varnir-Api-Key header	1,200

Per identity, for signed requests, by plan (counted once the signature has been checked):

Plan	Limit
Free	120
Hobbyist	300
Trader	1,200

Plans are not assigned to API callers yet, so every identity is counted at the Free limit today.

Some routes have their own, tighter limit per IP:

Route	Limit
POST /api/faucet	10
POST /api/pairing, GET /api/pairing/[id], POST /api/pairing/[id]/request (phone pairing; a separate bucket each)	20
POST /api/tokens/submissions	5
POST /api/withdrawals/speed	30
POST /api/recovery/[id]/origin	10
PUT /api/users/[id]/notifications (when it sets a new email), POST .../notifications/resend	10
POST / DELETE /api/users/[id]/push-devices (the phone app's push registration)	30

The notification routes are also capped per identity at five confirmation emails a day, with a wait between sends; those refusals are a 429 too, without a Retry-After header.

How exact they are

Not exact. The limits run on Cloudflare's Workers rate limiting, which counts per Cloudflare location rather than globally, so treat them as a brake on bursts rather than a precise quota. Preflight (OPTIONS) requests are not counted. Direct transactions to a ledger node do not go through the scanner API and are not covered by these limits.