Rate limits
Two families of limit - what your plan allows, and how fast anyone may call an endpoint - with the numbers served by the API that enforces them.
cmssy enforces two different kinds of limit, and they answer different questions. A plan allowance says how much of the product your organization bought: pages, storage, delivery requests per month. A protection guard says how fast anyone may call one endpoint, on any plan. A request can sit comfortably inside your allowance and still be refused by a guard, and the guard is the one that answers 429.
What a 429 means
Every guard refuses the same way: HTTP 429 with a Retry-After header carrying the number of seconds until the window reopens. Wait that long, then retry.
The window is fixed, not a bucket that drains while you knock. A client that treats 429 as if it were 500 and retries straight away stays refused for the rest of the window, and burns its own capacity doing it. Read the header.
Delivery is budgeted per workspace
The delivery API is the one you call from your own server, so its budget is per workspace, not per caller. Every visitor to your site is rendered from a handful of your regional IPs, and a crawler warming a cold cache would spend a per-caller budget in seconds. The second delivery row is that wider abuse net, counted per address - the address that reaches us, whatever token it carries - and it is not the budget your site runs against.
A site that renders on its own server can tell us which visitor a request is for: send the visitor's address in x-cmssy-client-ip together with a workspace-scoped API token in x-cmssy-api-token, and every per-address budget - delivery, cart, member sign-in, form submissions - is counted per visitor instead of per server. The pair is honoured only when the token belongs to this workspace and its owner still has access to it; keep it server-side, never in a browser. The token is validated once a minute per server, and that validation costs your server one slot of its own delivery budget. While the pair is honoured, Retry-After and the X-RateLimit-* headers describe the visitor's bucket, and X-RateLimit-Scope names the scope that answered: workspace or caller.
Every read counts, cached or not. A CDN in front of your site is how you stay inside the budget, because it cuts the reads that reach us at all - but a read that does reach us is counted whether or not you cache the answer.
Depth is not a rate
Two guards are measured in levels, not requests: a query nested deeper than the limit is rejected on the spot, and waiting changes nothing. Flatten the query.
Monthly allowances are pooled
Plan allowances belong to the organization, not to a single workspace. Delivery requests and bandwidth are pooled across every workspace the organization owns, and counted for the calendar month.
Reading the tables
Both tables below are served by the API that enforces the numbers, so this page cannot drift from the product. Rows marked as adjustable are the ones an operator can move for a deployment; every other number is the same for everyone.