Reference
Rate limits and headers
The body is the market data. The headers are the request id, the budget, and how old the payload is. Read both.
One budget
After a good auth, one api_user_id has a single ET-minute window shared by POST /api/v1 and POST /mcp/v1. The default is 120 requests. RateLimit-Limit is the number this server is actually using. The window resets on the America/New_York minute.
A successful market call counts as an attempt and as usage. initialize, tools/list, resources/list, and resources/read spend an attempt and do not add endpoint usage. A 422 spends an attempt and is not usage. A 429 spends the limit and is not usage. DATA_WARMING spends an attempt and is not usage.
Account reads
POST /api/v1/account/usage, /clients, and /status spend that same ET-minute budget, and a second counter. The default second budget is 30 requests per client id per ET minute. Over it, the code is ACCOUNT_RATE_LIMITED, Retry-After is set, and meta.rate_limit.scope is account. The RateLimit-* headers still describe the shared budget. The MCP tools get_account_usage, get_account_clients, and get_account_status use the same two counters. Field-level detail is on Account.
Response headers
| Header | When | How to use it |
|---|---|---|
Content-Type | Application JSON | application/json. |
Content-Encoding | You asked for gzip and the gzip body was chosen | Your client inflates it. curl needs --compressed. |
Vary | Market responses | Accept-Encoding. |
Cache-Control | Application responses | no-store. |
X-Request-ID | Every application response | Safe to log and to send to support. |
RateLimit-Limit | After auth | The gate size for this identity. |
RateLimit-Remaining | After auth | Attempts left in the current ET minute. |
RateLimit-Reset | After auth | Seconds until the next ET minute. Not a timestamp. |
Retry-After | 429 and the 503 rows that set it | Whole seconds. Wait at least this long. |
Age | A cached market body | Whole seconds since the payload was built. |
X-Data-Stale | A source missed its follow window | 1. Absence means the header is not set. Serve the body and treat it as lagging. |
WWW-Authenticate | 401 AUTH_REQUIRED | Bearer. |
Allow | 405 | POST on a market route. |
Headers you send
| Header | Value |
|---|---|
Authorization | Bearer 12345.YOUR_API_KEY |
Accept | application/json |
Accept-Encoding | gzip |
Content-Type | application/json on POST. |
There is no CORS. Keep the header block under 16 KiB.
Freshness of the numbers is meta.built_at, meta.generation, and Age, plus the route’s response-cache lifetime on each endpoint page. That lifetime is housekeeping. Compare generation if you poll.
TanukiTrade API and MCP. Derived options analytics for your code and for agents. Not investment advice. tanukitrade.com