Each kind has its own bucket, so a burst of quote requests never slows your reads. The bucket belongs to your client id: it is shared across every product you use, and sandbox and production count separately.
Calls the customer’s browser makes from the Yasmina iframe (
/car-comp/embed/*) are counted against the customer’s IP address instead, so your customers never share one bucket.
Two endpoints have a stricter, per-customer limit on top. POST /car-comp/quote-otp and POST /car-comp/issue-otp accept one request per phone number every three minutes, and answer 429 with code 42902 and the seconds left otherwise. The OTP already sent stays valid meanwhile.
POST /oauth/token is limited to 60 requests per minute per IP address. Cache the token: it is valid for the expires_in it comes with.
When you go over
The call is refused with429, the standard error envelope with code 42901, and the seconds to wait in both the body and the Retry-After header:
X-RateLimit-Limit and X-RateLimit-Remaining, so you can slow down before you are refused. Retry after retry_after_seconds; retrying sooner only extends the wait.