Rate limits & versioning
600 requests a minute per key, and the compatibility promise for /v1.
600 requests per minute, counted per key rather than per IP — an integration running from one server should not have to share a budget with every other caller on that address. Over the limit you get 429 with code: "rate_limited". Standard RateLimit-* headers are on every response, so you can back off before hitting it.
If you need per-device updates faster than polling allows, use webhooks — they are pushed as the device reports and do not count against this budget.
Our compatibility promise for /v1
- Fields are added, never removed or retyped within a version.
- Unknown fields in a request body are ignored, not rejected.
- A breaking change means
/v2, with/v1kept working.
Parse defensively anyway: tolerate fields you do not recognise rather than rejecting the response.