The Titan Public API enforces rate limits at the gateway to keep the platform stable and give every organization a fair share.
Rate limits are enforced per organization, not per credential pair or per source IP. The bucket key is the org claim from the OIDC bearer token — every credential that resolves to the same organization shares one counter.
Kong evaluates a sliding window across three fixed sizes. A request is rejected as soon as any of the three windows would be exceeded.
| Window | Requests |
|---|---|
| Per minute | 300 |
| Per hour | 3,000 |
| Per day | 30,000 |
The stricter window wins — a burst that fits under the per-hour cap can still be rejected if it exceeds the per-minute cap.
Every response carries the current limit state so you can back off proactively:
| Header | Meaning |
|---|---|
RateLimit-Limit | Ceiling for the current window. |
RateLimit-Remaining | Requests remaining in the current window. |
RateLimit-Reset | Seconds until the current window resets. |
Retry-After | Present only on 429. Seconds to wait before retrying. |
The gateway returns 429 Too Many Requests with the Retry-After header. Honour it — or use exponential backoff starting at 1 second, capped at 60 seconds. Retries without backoff amplify congestion and can lead to sustained throttling of your organization.
These limits cover the Public API surface only: routes under /public/<major>/*. Adjacent endpoints (OAuth token issuance, internal routes) have their own separately-tuned limits and are not part of the public contract.
Contact your SecurityScorecard account team. Include:
- Your organization identifier (never credential secrets).
- The endpoints and request volume you expect.
- Whether the traffic is steady or bursty.
Do not attempt to work around limits by rotating credentials or sourcing from multiple IPs — the counter is keyed by organization, and coordinated evasion is treated as abuse.