Rate limits - Cotality developer portal

Specific rate limit values depend on your entitlement tier and are defined in your service agreement. Contact your Cotality account representative for the limits applicable to your token.

MCP quotas

Cotality MCP applies three independent controls at the gateway.

Control	Scope	Default	Overridable
Request quota	Per `client_id`	60 requests per minute	Yes — set on your API product
Per-user quota (PKCE)	Per authenticated user	25 requests per minute	Yes — set on your API product
Spike arrest	Per gateway target	200 requests per second	No

The client_id quota is counted per client_id, not per token — issuing a fresh access token does not reset it. For the user-to-service flow (authorization_code with PKCE), a separate 25 requests per minute quota is enforced per signed-in user, on top of the application’s client_id quota — see Authentication for the flow difference. Every tools/call counts as one request; tools/list, prompts/list, and resources/list also count against both quotas.

Batch where the tool allows it. pd-get_property_characteristics and the risk tools accept up to 50 CLIPs per call, and the analytics tools accept up to 50 geographies — a batched call costs one request instead of 50. See Input limits.

General guidance

Scenario	Recommended approach
Sustained high-volume queries	Batch CLIP inputs where tools accept `array[string]`
Burst spikes	Implement exponential backoff with jitter
Portfolio-scale ingestion	Use batch endpoints or request a bulk data entitlement

HTTP 429 — Too many requests

When you exceed a limit, the gateway returns 429 with Apigee’s default fault body. Neither policy sets a custom response, so you get the shape below rather than the Cotality REST envelope, and there is no Retry-After header — you must supply your own back-off. Quota exceeded (more than 60 requests in a minute):

{
  "fault": {
    "faultstring": "Rate limit quota violation. Quota limit exceeded. Identifier : _default",
    "detail": { "errorcode": "policies.ratelimit.QuotaViolationCaughtRateLimit" }
  }
}

Spike arrest tripped (more than 200 requests in a second):

{
  "fault": {
    "faultstring": "Spike arrest violation. Allowed rate : 200ps",
    "detail": { "errorcode": "policies.ratelimit.SpikeArrestViolation" }
  }
}

Through an MCP client the 429 surfaces as a transport-level error on the request, not as a ToolError payload — the gateway rejects it before it reaches a server. Handle it in your HTTP layer, not in tool-result parsing.

Back-off pattern for agents

On 429:
  wait = min(base * (2 ^ attempt) + random_jitter, max_wait)
  retry up to 3 times
  if still 429 after 3 attempts: stop and surface to user

MCP tool errors — the retryable flag and MCP error codes
Error handling — full HTTP status code reference
Response envelope — envelope shape on errors

​MCP quotas

​General guidance

​HTTP 429 — Too many requests

​Back-off pattern for agents

​Related

MCP quotas

General guidance

HTTP 429 — Too many requests

Back-off pattern for agents

Related