nfa.pubRate limits and errors
Every limit is per minute, and every failure comes with a stable code. Handle the few codes that matter to your flow and log the rest.
Rate limits
Over a limit you get HTTP 429 with E1002, and nothing happens: no charge, no order. Wait for the minute to roll over and retry.
| Endpoints | Limit | Counted per |
|---|---|---|
/cs2 /rust /extra | 120 a minute | IP address. Counted before the key is looked up, so guessing keys is throttled too. |
/cs2 /rust /extra | 30 a minute | Account (all keys together). Shared by every key on the account, across all three buy endpoints. |
/products | 60 a minute | IP address |
/stock | 60 a minute | IP address |
/balance | 120 a minute | IP address |
/limits | 120 a minute | IP address |
/order | 120 a minute | IP address |
/replace | 60 a minute | IP address |
/replace | 20 a minute | Key |
/preorder/hours /preorder/cancel | 60 a minute | IP address |
/preorder/hours /preorder/cancel | 20 a minute | Account (all keys together). Shared by every key on the account, across both pre-order endpoints. |
/me | 120 a minute | IP address |
/orders | 60 a minute | IP address |
/ledger | 60 a minute | IP address |
/orders | 30 a minute | Account (all keys together) |
/ledger | 30 a minute | Account (all keys together) |
/webhooks /webhooks/{id} /webhooks/{id}/rotate /webhooks/{id}/enable /webhooks/{id}/test /webhooks/{id}/deliveries | 120 a minute | IP address |
/webhooks /webhooks/{id} /webhooks/{id}/rotate /webhooks/{id}/enable /webhooks/{id}/test | 20 a minute | Account (all keys together). Changes only: creating, deleting, rotating, enabling and testing endpoints. |
/webhooks/{id}/test | 6 a minute | Account (all keys together). On top of the limit on changes. |
Buys count per account, so every key on it shares one allowance. Most reads count per IP address. /me returns this table as rateLimits, so your code can read it.
Errors
Every failed request has a code like E1401 in the X-Error-Code header, in every format. With result=json the body has the same code and an error sentence.
{ "ok": false, "code": "E1401", "error": "Not enough balance on the account this key belongs to. Reference E1401."}Branch on code. The error sentence is safe to show your own customers, but its wording can change, so do not parse it.
What to do
| Code | What to do |
|---|---|
E1002 | Wait for the next minute and retry. |
E1401 | Top up, then retry. Nothing was charged. |
E1501 | Not enough stock. Retry later, or add preorder=1. |
E1503 | The supplier is briefly down. Retry shortly; nothing was charged. |
E1506 | Wait the Retry-After seconds, or add preorder=1. |
E1502 | Delivery failed and your balance was refunded. Retry. |
E1301 | That Idempotency-Key was used with other parameters. Use a new key for a new order. |
E1302 | The first call with that key is still running. Retry shortly with the same key. |
E1701 to E1708 | Your own API protection refused it. Check your settings. |
E1000 | Our side. Retry, and contact support if it keeps happening. |
Only E1506 comes with a Retry-After header. The full list is in Error codes.