Skip to main content

Overview

PromptGuard implements two types of limits to ensure fair usage and system stability:
  1. Monthly Request Quotas - Based on your subscription plan
  2. Rate Limiting - Maximum requests per minute (anti-abuse)

Monthly Request Quotas

Your subscription plan determines how many requests you get per month: These apply to every counted request, on every endpoint: the proxy, POST /api/v1/guard and POST /api/v1/security/scan alike. The full list of what counts is in Plans & Limits. Scans from the Shadow AI desktop agent count against the same quota but are never refused for it.

Hard vs Soft Limits

Free and Pro plans use hard limits:
  • When you exceed your monthly quota, requests return 429 Too Many Requests
  • Free (20K) → upgrade to Pro (100K) to continue
  • Pro (100K) → upgrade to Scale (500K), or enable pay-as-you-go with a spend cap you choose
Scale plan uses a soft quota with a hard spend cap:
  • When you exceed 500K requests/month, requests continue processing
  • Overage is metered at $0.40 per 1,000 requests, on by default
  • You receive email alerts about overage
  • Spending is bounded by your cap (default $500); past it requests return 429 until you raise it
  • Set the cap to $0 to stop at the quota instead of paying overage
Example (Scale plan):

Checking Your Usage

View current usage in the dashboard:
Or via API:

Rate Limiting

PromptGuard enforces per-plan, per-account rate limits on all /api/v1/* endpoints: These limits apply to your whole account; adding more API keys does not increase them, and neither does creating more organizations. The account is the one that pays: every organization you own shares your plan’s limit, and a teammate’s keys in your organization get your plan’s limit, whatever plan they are on themselves. The budget refills at the start of each minute. Scans from an enrolled Shadow AI device neither count toward it nor are refused by it. Separately, a Cloud Armor anti-abuse layer enforces a per-IP request limit at the network edge. The per-IP limit is independent of your plan and exists to block abusive traffic.

Rate Limit Headers

Every /api/v1/* response carries your plan’s limit and the window reset:
X-RateLimit-Remaining does not count down against X-RateLimit-Limit. It is emitted by the network-edge anti-abuse layer, tracks a per-IP window rather than your plan, and is absent on many responses. Do not build backoff logic that requires it — use X-RateLimit-Limit with X-RateLimit-Reset, and treat a 429 plus Retry-After as the authoritative signal.
Enterprise organizations can request custom rate limits by contacting sales.

Handling Rate Limits

If you exceed your plan’s per-minute rate limit, you’ll receive a 429 Too Many Requests response:
retry_after (and the Retry-After header) is the number of seconds until the minute ends and your budget refills. Recommended handling:

Idempotency Keys

For safe retries of POST/PUT/PATCH requests, include an Idempotency-Key header:
If you retry the same request with the same idempotency key within 24 hours, you’ll get back the cached response with an X-Idempotency-Replayed: true header. This prevents duplicate operations.
Idempotency keys are scoped to your API key and expire after 24 hours.

Best Practices

1. Implement Exponential Backoff

2. Monitor Usage Proactively

Set up monitoring to alert before you hit limits:

3. Batch Requests When Possible

Instead of:
Use batch processing:

4. Cache Responses

Cache frequently requested results:

Upgrading for Higher Limits

Need higher rate limits or custom quotas? Enterprise plans offer:
  • Custom rate limits per organization
  • Custom monthly request quotas
  • IP allowlisting for API access control
  • Idempotency keys for safe retries
  • Dedicated support and SLA guarantees
Contact us at sales@promptguard.co for Enterprise pricing.

Frequently Asked Questions

Why do different plans have different rate limits?

Rate limits scale with your plan tier (Free: 60/min, Pro: 300/min, Scale: 600/min, Enterprise: 1,000/min). These are per-account limits. The Cloud Armor per-IP limit is a separate anti-abuse layer at the network edge.

What happens if I consistently go over my monthly quota?

For Free and Pro plans, requests are blocked with 429 errors (on Pro, until you upgrade or enable pay-as-you-go). Scale keeps processing past the quota, metered up to your spend cap; past the cap requests return 429 until you raise it. Enterprise continues processing per contract. You’ll receive email alerts at 80%, 90%, and 100% usage thresholds.

Can I increase my rate limit?

Yes. Enterprise plans support custom rate limits configured per organization. Contact sales@promptguard.co.

Do retries count against my quota?

Yes. Every request to our API counts, including retries. Implement smart retry logic with exponential backoff to minimize wasted quota.

How is usage calculated?

One request = one call to a counted endpoint (the proxy, /api/v1/guard, /api/v1/security/scan or /api/v1/security/redact — the full list is in Plans & Limits), regardless of:
  • Number of tokens
  • Response length
  • Model used

Monitoring Tools

Dashboard Analytics

Track usage in real-time:
  • Current period usage
  • Daily/weekly/monthly trends
  • Over-quota events
  • Rate limit hits

Usage API

Programmatically monitor usage:
Returns:

Need Help?