Rate limits

Limit	Applies to	Scope
600 requests a minute	Requests with a valid key	Per key
60 failed authentications a minute	Requests with a missing or invalid key	Per IP address

Going over either answers 429 rate_limited with a Retry-After header giving the seconds to wait.

The second limit refuses every request from that address until the minute passes, including requests with a valid key. A misconfigured client sharing an address with a working one can block both, so fix repeated 401s rather than retrying them.

Handle a 429

Wait for the time in Retry-After, then retry. The same applies to 503 quota_unavailable and cloud_unavailable, which also send it.

curl -s --retry 5 "$BASE/orgs" \
  -H "Authorization: Bearer $BREQWATR_API_KEY"

--retry covers 429 and 503, and curl waits for Retry-After when the server sends it.