RPM abuse protection (PHASE 3A)
Authenticated gateway requests use a fixed one-minute window per API key and environment. Default: 60 requests per minute. This is infrastructure protection, not billing.
X-RateLimit-Limit: 60 X-RateLimit-Remaining: 59 X-RateLimit-Reset: 1710000060
Exceeded → HTTP 429 with code RATE_LIMIT_EXCEEDED.
Technical sandbox quota (PHASE 3B)
After authentication, the gateway enforces a cumulative technical allowance. Default: 1000 request units per UTC day per organization/environment (ARBEBUS_GATEWAY_DEFAULT_DAILY_REQUEST_UNITS). Project overrides may be applied server-side. Callers cannot choose their own quota.
These are technical platform quotas, not Free/Developer/Business/Enterprise commercial entitlements. Billing plans arrive in PHASE 4.
- Metric for sandbox:
request_units(accepted sandbox ping consumes 1) - Idempotent successful replay consumes 0 additional units
- Unauthenticated invalid keys do not consume customer quota
- Token quotas are reserved and not enforced until real AI token metering exists
X-Arbebus-Quota-Limit: 1000 X-Arbebus-Quota-Remaining: 999 X-Arbebus-Quota-Reset: 1710086400 X-Arbebus-Quota-Metric: request_units
Exceeded → HTTP 429 with code QUOTA_EXCEEDED.
Headers
Both RPM and quota headers are returned on authenticated sandbox responses when applicable. Internal quota row IDs are never exposed.
429 distinction
RATE_LIMIT_EXCEEDED— short abuse window (minute RPM)QUOTA_EXCEEDED— cumulative technical allowance exhausted