Rate limits
Two families of limit - what your plan allows, and how fast anyone may call an endpoint - with the numbers served by the API that enforces them.
cmssy enforces two different kinds of limit, and they answer different questions. A plan allowance says how much of the product your organization bought: pages, storage, delivery requests per month. A protection guard says how fast anyone may call one endpoint, on any plan. A request can sit comfortably inside your allowance and still be refused by a guard, and the guard is the one that answers 429.
What a 429 means
Every guard refuses the same way: HTTP 429 with a Retry-After header carrying the number of seconds until the window reopens. Wait that long, then retry.
The window is fixed, not a bucket that drains while you knock. A client that treats 429 as if it were 500 and retries straight away stays refused for the rest of the window, and burns its own capacity doing it. Read the header.
Delivery is budgeted per workspace
The delivery API is the one you call from your own server, so its budget is per workspace, not per caller. Every visitor to your site is rendered from a handful of your regional IPs, and a crawler warming a cold cache would spend a per-caller budget in seconds. The second delivery row is that wider abuse net, counted per caller - the token and the IP together, so two tokens behind one address get two buckets - not the budget your site runs against.
Every read counts, cached or not. A CDN in front of your site is how you stay inside the budget, because it cuts the reads that reach us at all - but a read that does reach us is counted whether or not you cache the answer.
Depth is not a rate
Two guards are measured in levels, not requests: a query nested deeper than the limit is rejected on the spot, and waiting changes nothing. Flatten the query.
Monthly allowances are pooled
Plan allowances belong to the organization, not to a single workspace. Delivery requests and bandwidth are pooled across every workspace the organization owns, and counted for the calendar month.
Reading the tables
Both tables below are served by the API that enforces the numbers, so this page cannot drift from the product. Rows marked as adjustable are the ones an operator can move for a deployment; every other number is the same for everyone.