# Limit

Too many requests, or an allowance used up. 429.

Pattern: `limit.*` (this page) · Raised with: [`fail()`](https://www.prongs.dev/docs/profiles/errors.md) · Intents: [1](#intents) · Statuses: `429`

## Intents

| Intent | Status | Use it for |
|---|---|---|
| [`limit.rate`](https://www.prongs.dev/docs/intents/limit/rate.md) | `429` | Too many requests in a short time; the caller should wait |

## Raising one

Name what went wrong. The intent sets the status, the message the caller sees, and any log it writes.

```ts
// Too many requests in a short time; the caller should wait
return fail('limit.rate', undefined, { retryAfter: 30 });
```

The caller gets (limit.rate)

```bash
HTTP 429
Retry-After: 30

{
  "ok": false,
  "error": "Too many requests. Try again shortly.",
  "code": "limit.rate"
}
```

And it writes security.limited (limit.rate)

```ts
{
  "intent": "security.limited",
  "level": "warn",
  "alert": false,
  "message": "Too many requests. Try again shortly.",
  "data": {
    "intent": "limit.rate"
  },
  "time": "2026-10-09T12:00:00.000Z"
}
```

## Is it a limit error?

Find the row that describes your case, and use the domain on the right.

| If the problem is | Use |
|---|---|
| The caller’s request was wrong: unreadable, incomplete, or a value that breaks a rule. 400 or 422. | [`request.*`](https://www.prongs.dev/docs/intents/request.md) |
| No valid credentials: nobody signed in, an expired session, a bad token or secret. 401. | [`auth.*`](https://www.prongs.dev/docs/intents/auth.md) |
| Valid credentials, but not allowed to do this. 403. | [`permission.*`](https://www.prongs.dev/docs/intents/permission.md) |
| The thing asked for is not there, as far as the caller may know. 404. | [`record.*`](https://www.prongs.dev/docs/intents/record.md) |
| The request clashes with the current state: it already exists, or it is not possible yet. 409. | [`conflict.*`](https://www.prongs.dev/docs/intents/conflict.md) |
| Too many requests, or an allowance used up. 429. | `limit.*` (this page) |
| Our fault or a dependency’s. The caller sees a generic message; the details are logged. 5xx. | [`failure.*`](https://www.prongs.dev/docs/intents/failure.md) |

## For registry authors

**Starter intents.** These are the intents `prongs add errors` puts in your registry, raised with [`fail()`](https://www.prongs.dev/docs/profiles/errors.md). Change the messages to suit your app, and the statuses through the [`status.*`](https://www.prongs.dev/docs/intents/errors.md#status) intents they are built from.