# Agent rate limits & observability

Agents reach Exayard two ways: the REST API at `https://api.exayard.com/v1` and the MCP server at
`https://api.exayard.com/mcp`. Each has its own limits, so agent traffic on MCP does not use up REST allowance.

## REST

REST calls follow [Rate limits](https://developers.exayard.com/concepts/rate-limits.md): 60 calls a minute per API key or signed-in person, 60 a minute
per OAuth client and person for personal connections (ChatGPT, Claude, Cursor), and the per-company and ceiling
limits for registered apps.

## MCP

- **Signed-in callers: 240 requests a minute**, counted per person (or per API key, for a key). Every request to the
  MCP address counts, not only tool calls. Two clients used by the same person share that person's allowance.
- **Registered apps** get their own limits instead: per company, named by the `Exayard-Organization-Id` header, and a
  ceiling across all companies, the same numbers as on REST.
- **Addresses that work without signing in** are limited per IP address, 120 requests a minute.

MCP responses carry `RateLimit` and `RateLimit-Policy` (not the `X-RateLimit-*` trio), and a 429 carries
`Retry-After`. A refusal is a JSON-RPC error with code `-32000` and a sentence saying which limit was hit and when to
try again.

There is no separate limit on how much an agent's responses produce; only requests are counted.

## Which client did this

When a call comes from an OAuth client, Exayard reads the client id the authorization server reports for the token
and records it on the call's audit entry, so the record tells "Claude acting for Alice" from Alice herself. A client
that is a registered app is recorded as that app, with the company the call named, and admins of the installing company
see the app's calls in the Logs panel of their Developer page.

## Gateway integration

You can put your own gateway (Kong, Traefik Hub, Databricks Unity AI Gateway) in front of `https://api.exayard.com/mcp`
and apply stricter per-client policies there. Our limits are the floor. The `RateLimit` headers describe the counter
nearest to running out, so a gateway can pace itself without counting twice.