Content API Limits

Every number on this page is enforced by the API. Where a value has no enforced limit, the table says so; the request body cap still applies to it.

Request size

Field lengths

Ids per request

List pages

Resource lists (modules, courses, videos, slides, tests, games, and simulations) return the { "data", "meta" } envelope described in List responses, and all take the same query parameters:

Deleted rows are not listed. To learn about deletions, use the resource.deleted webhook.

The webhook delivery log pages differently: limit 1 to 100 (default 20), always newest first, with before for the next page and status and eventType filters. See Delivery log.

The credit history, audit log, generation runs, learners, enrollments, and test results page with a cursor instead: limit (default 20, values above 100 clamped to 100) and cursor, newest first, with { "data", "meta": { "limit", "hasNextPage", "nextCursor" } }. See Paging.

These routes return a plain array with no paging: GET /v1/content/classrooms, GET /v1/content/organizations, the API key list, and the webhook list. A course's GET .../chapters returns the whole curriculum with no paging, as { "data", "unassignedLessons" }.

Source JSON expansion

Upload limits

Past a daily limit, asking for an upload URL answers 429 content_asset_daily_limit_reached with Retry-After.

Webhook delivery

See Endpoint health.

Rate limits

Each key has its own budget, rateLimitPerMinute (1 to 600, default 60), counted over a 60-second window. The budget is shared across every route the key calls, and a busy key never uses up another key's budget. Requests refused with 401, or with 403 for a missing scope or classroom, are not counted against the key.

Every counted response carries:

A request over the limit returns 429:

{
  "error": {
    "code": "content_rate_limit_exceeded",
    "message": "Rate limit exceeded. Retry after 12 seconds",
    "retryAfterSeconds": 12,
    "status": 429
  }
}

Wait for Retry-After, then send the same request again with the same Idempotency-Key:

// Node.js 18+
async function fetchWithRateLimit(url, init, maxAttempts = 5) {
  for (let attempt = 1; ; attempt++) {
    const response = await fetch(url, init)
 
    if (response.status !== 429 || attempt === maxAttempts) {
      return response
    }
 
    const waitSeconds = Number(response.headers.get('retry-after') ?? '1')
    await new Promise((resolve) => setTimeout(resolve, waitSeconds * 1000))
  }
}

# Python 3 with requests
import time
import requests
 
def request_with_rate_limit(method, url, max_attempts=5, **kwargs):
    for attempt in range(1, max_attempts + 1):
        response = requests.request(method, url, timeout=30, **kwargs)
 
        if response.status_code != 429 or attempt == max_attempts:
            return response
 
        time.sleep(int(response.headers.get("Retry-After", "1")))

To stay under the limit in a batch, read X-RateLimit-Remaining and pause until X-RateLimit-Reset when it reaches 0. Browser clients can read these headers, and Retry-After: the Content API lists them in Access-Control-Expose-Headers. A complete wrapper that also handles 5xx, 402, and 409 is in Examples.

Failed authentication limit

Separate from the per-key budget, each client address may fail authentication (401) up to 300 times in a one-minute window. Once it reaches that, every request from the address to a tf_content_ route answers 429 content_rate_limit_exceeded, with Retry-After and error.retryAfterSeconds, until the window ends. The check runs before the key is looked up, so it applies even to requests with a valid key from that address.

Only 401s count, so valid traffic from one address is never limited by this; the per-key limits above apply to it instead. These 429s carry no X-RateLimit-* headers. If you see one, stop retrying with the bad key: fix the key, wait Retry-After, then resume.

Time limits and retention

No enforced limit

These have no limit in the API today. If one is added, it is announced in the Changelog first, as described in Versioning and Deprecation.

• Webhook endpoints per organization.
• Webhook payload size. Payloads are small JSON objects; they do not carry built HTML or media.
• Content API keys per organization.
• Classrooms per key allowlist.
• Resources per classroom.
• Concurrent expansion jobs per key, beyond the rate limit.