Agent rate limits & observability

Agents reach Exayard two ways: the REST API at https://api.exayard.com/v1 and the MCP server at https://api.exayard.com/mcp. Each has its own limits, so agent traffic on MCP does not use up REST allowance.

REST

REST calls follow Rate limits: 60 calls a minute per API key or signed-in person, 60 a minute per OAuth client and person for personal connections (ChatGPT, Claude, Cursor), and the per-company and ceiling limits for registered apps.

MCP

Signed-in callers: 240 requests a minute, counted per person (or per API key, for a key). Every request to the MCP address counts, not only tool calls. Two clients used by the same person share that person's allowance.
Registered apps get their own limits instead: per company, named by the Exayard-Organization-Id header, and a ceiling across all companies, the same numbers as on REST.
Addresses that work without signing in are limited per IP address, 120 requests a minute.

MCP responses carry RateLimit and RateLimit-Policy (not the X-RateLimit-* trio), and a 429 carries Retry-After. A refusal is a JSON-RPC error with code -32000 and a sentence saying which limit was hit and when to try again.

There is no separate limit on how much an agent's responses produce; only requests are counted.

Which client did this

When a call comes from an OAuth client, Exayard reads the client id the authorization server reports for the token and records it on the call's audit entry, so the record tells "Claude acting for Alice" from Alice herself. A client that is a registered app is recorded as that app, with the company the call named, and admins of the installing company see the app's calls in the Logs panel of their Developer page.

Gateway integration

You can put your own gateway (Kong, Traefik Hub, Databricks Unity AI Gateway) in front of https://api.exayard.com/mcp and apply stricter per-client policies there. Our limits are the floor. The RateLimit headers describe the counter nearest to running out, so a gateway can pace itself without counting twice.