Too Many Requests

Active

RFC 6585 §4•Since 2012•APIs, Rate Limiting

HTTP 429 Too Many Requests indicates the user has sent too many requests in a given time period. Defined in RFC 6585 §4. The server SHOULD include a Retry-After header indicating how long to wait before making a new request.

Description

The 429 Too Many Requests status code indicates that the user has sent too many requests in a given amount of time ("rate limiting"). The response representations SHOULD include details explaining the condition, and MAY include a Retry-After header indicating how long to wait before making a new request.

Note that this specification does not define how the origin server identifies the user, nor how it counts requests. Rate limiting can be per-user, per-IP, per-API-key, per-resource, or across the entire server.

Examples

Request that triggers rate limit

http

GET /api/data HTTP/1.1
Host: api.example.com
Authorization: Bearer token123

429 response with Retry-After

http

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json
X-RateLimit-Limit: 100 X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1702400000

{"error": "rate_limit_exceeded", "message": "Rate limit of 100 requests per minute exceeded. Retry after 60 seconds."}

Edge Cases

•Responses with 429 MUST NOT be stored by a cache.
•The Retry-After value can be in seconds or an HTTP-date.
•Some CDNs return 429 from edge nodes before the request reaches your origin server.
•Rate limits may apply differently to authenticated vs unauthenticated requests.

When You'll See This

→API rate limit exceeded
→Too many login attempts (brute-force protection)
→Web scraping detection
→DDoS mitigation by reverse proxies

Implementation References

Language	Constant
Go	http.StatusTooManyRequests
Rust	http::StatusCode::TOO_MANY_REQUESTS
Python	http.HTTPStatus.TOO_MANY_REQUESTS
Node.js	http.STATUS_CODES[429]
.NET	HttpStatusCode.TooManyRequests
Java	(no built-in constant, use 429 literal)

History

Introduced in RFC 6585 (April 2012) as part of 'Additional HTTP Status Codes'. Created because 403 was being overloaded to mean rate-limited, which confused the semantics.

Related Status Codes

503 Service Unavailable 403 Forbidden

Related Headers

Retry-After

FAQ

What does HTTP 429 Too Many Requests mean?

HTTP 429 means you've sent too many requests in a given time window (rate limiting). Wait for the time specified in the Retry-After header before retrying.

How should I handle a 429 response?

Implement exponential backoff: wait the Retry-After duration, then retry. If no Retry-After header, wait progressively longer between retries (1s, 2s, 4s, 8s...).

Source: RFC 6585 §4