# Limits and pagination

> Request rate per key, page sizes and keyset cursors.

## Rate limit

Each API key may make **120 requests per 60 seconds**. Responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`; when the limit is reached the answer is `429 RATE_LIMITED` with `Retry-After` in seconds. MCP tool calls count against the same key.

## Pagination

Lists that can grow use keyset pagination:

- `limit` — page size, default 50, maximum 100.
- `cursor` — the `page.next_cursor` of the previous page.

```json
{ "data": [ … ], "page": { "limit": 50, "next_cursor": "eyJ…" }, "correlation_id": "…" }
```

Follow `next_cursor` until it is `null`. Rows never repeat across pages even while others are being added. The SDK's `paginate()` and the CLI's `--all` do this for you.

## Bulk operations

`profiles.trash` and `profiles.restore` accept up to 1,000 ids, `proxies.delete` up to 500, and `flows.run` up to 1,000 profiles. They report a result per item, so one refused item never hides the others.

## Workspace limits

Limits such as the number of concurrent sessions are set per workspace. `usage.get` shows current use against any configured limit; `limit: null` means none is set.