Skip to content
LEAPDocs
2026.08

Rate limits

What is capped, at what level, and how to recognise a rate limit rather than an outage.

The limits

Per userDefault: 100 requestsWindow: 60sThe general API limit. Generous for normal use; reachable by polling plus rapid navigation.
Per IPDefault: 6,000 requestsWindow: 60sA blunt outer bound. Sized so a whole institution behind one NAT address is not throttled.
LLM endpointsDefault: 5 requestsWindow: 60sFar tighter, because cost is measured in tokens rather than milliseconds.
Scan uploadsDefault: 60 per minuteWindow: per teacherPaced so a full class of scripts can be captured without tripping the general limit.

What being limited looks like

Intermittent “failed to load” is usually this

A screen that loads on retry, fails for one user but not another, and correlates with heavy navigation is almost always the per-user limit rather than a session problem or an outage. Background polling plus a burst of clicks can reach 100 requests a minute more easily than it sounds.

Tuning

All four limits are environment configuration, not code. Raising the per-user limit is the usual response to a legitimate heavy-usage complaint; raising the LLM limit is not, since it directly raises spend.

Other caps

  • Scan uploads: 10 MB per file, 500 MB per capture session, 200 files per session.
  • Request bodies are capped, so an oversized upload is rejected at the edge rather than consuming a worker.
  • The WAF applies its own global rate rules in front of all of this.