What the API enforces, body size and timeout budgets, and CORS.
Enforced by tier
Requests per minute, per day and per month, all keyed to your tier
Free Developer: 10 per minute, 500 per day. Pay As You Go: 60 per minute, 20,000 per day. Scale: 120 per minute, 1,00,000 per day. Enterprise: custom, up to 600 per minute. Every tier also carries a per month ceiling, counted per account rather than per key. Windows are counted per API key for the per minute limit and per account for per day and per month, and every successful response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset so you can budget against the real number rather than guessing.
// HTTP 429, eleventh request inside the same minute on one key
{
"error": "Rate limit exceeded",
"message": "Too many requests. Maximum 10 requests per minute allowed.",
"retryAfter": 37,
"resetTime": "2026-08-10T09:41:12.884Z"
}
// Successful responses carry the budget in headers
X-RateLimit-Limit: 10
X-RateLimit-Remaining: 6
X-RateLimit-Reset: 2026-08-10T09:41:12.884ZEach tier caps the limit value a search endpoint will accept (20 on Free, 50 on Pay As You Go, 100 on Scale and Enterprise) and how deep you can page or cursor into one query. A request that asks for more than your tier's page size is rejected before it reaches the search layer, not silently clamped.
Distinct case fetches per day and PDF calls per month are enforced per tier, refusing with DISTINCT_CASES_LIMIT_REACHED and PDF_LIMIT_REACHED respectively (HTTP 429, with a Retry-After header) once a tier's cap is reached. Analyze requests also apply a concurrency limit, refusing with CONCURRENT_ANALYSIS_LIMIT (HTTP 429, with a Retry-After header) when too many jobs run at once. Additional abuse protections apply beyond the published tier limits; contact support for a legitimate high-volume or shared-IP integration.
Every request body is capped at 256 kb; a larger body is refused with HTTP 413 PAYLOAD_TOO_LARGE before it is parsed. Set a client side timeout well above these figures, and treat your own timeout as your client giving up on reading the response, not as cancelling the call: a request that is already running on our side keeps running and, if it succeeds, still charges credits. Your timeout does not cancel work in progress and does not refund anything.
| Endpoint | Budget |
|---|---|
| POST /search/cases/semantic | Up to 10 minutes for a cold, heavily filtered query. Most calls finish in seconds; the connection is held open rather than cut early. |
| POST /request-timeline (refresh: true) | Up to 210 seconds for the live court portal fetch. A stored read (refresh omitted or false) answers immediately. |
| POST /cases/:id/analyze-consolidated | Synchronous: the call runs the model before it answers, rather than handing back a job id to poll. Budget for a genuinely long single request. |
| Everything else | Seconds, bounded by the underlying search query. |
Every keyed endpoint is meant to be called server side. There is no key you can safely put in front end JavaScript: a key visible to a browser is a key visible to everyone who opens dev tools, and it will be used against your balance and your rate limit. The public, no key endpoints that exist specifically for a browser to call directly, GET /coverage, GET /reference/courts and GET /reference/case-types do carry CORS headers for that reason. Every keyed endpoint does not. Proxy through your own backend if you need to reach this API from client side code at all.