united-kingdom is-x-legal
Does an API with a rate limit need to provide requests remaining?
<p>I'm writing code to make requests from a public API. They give me an API key, and the API provides 1000 requests per day for free, and a max of 60 per minute. In the event that I pass one of those limits, I will be liable for a fee. I don't have to enter my payment details to use the API.</p>
<p>This all seems fine. However, there is no count of how many requests I've used on a given day on the website or on my account page, nor in the API's response (in the response header or data). So, given a line of code that calls the API, there is no way for me to know whether running it will cost me money. When I ask the company, they say it's up to me to add a counter and keep track. So unless all my applications/environments tell each other how many requests I've used, then I have no means of tracking how many I have remaining. In addition, I don't know what time the count resets each day, or each minute. So even if I keep track and only have one application that uses the API, there's no way for me to know if my count equals their count because I don't know when they reset it.</p>
<p>The only thing they'll tell me is when I owe them money by going over the limit. Is this okay, or is there some legal expectation that they tell me when a request will cost me money, such as returning a count of requests remaining this day/minute?</p>
<p>The company's headquarters is in the UK, but the API is used worldwide.</p>
<p><strong>Edit:</strong> After some further looking at the company's website and documentation, and comparing to what it used to say using Archive.org, I've determined that it will probably not incur charges if I reach a limit, but further requests will instead return HTTP 429 (the code for &quot;rate limit exceeded&quot;), which seems much more reasonable.</p>

<p>You could establish your own server which calls the API and maintains a counter, and have al your applications call that server, the server call the API, and the server can also return a count to the application, or  even return a failure code if the count is too high.</p>
<p>As for when the count turns over, a few days experiment should establish that, but given that the API is based in the EU, I would guess it turns over at midnight UTC (aka Greenwich mean time), but of course that is only a guess.</p>
<p>Has the API management declined even to tell when the count rolls over?  That seems odd.</p>
<p>As to the legal obligations of the API management, it would be good practice for them to  have the API return a count, but I don't see that they can be required to do that. I don't know of (and could not find) any law which mandates such a count. I do think that they should inform you of the time of day at which they roll the count over. I have not yet found a law which specifically requires this.</p>

<p>No, they don't have to give you the count, count your requests yourself.</p>
