Skip to content

Crypto Playground Rate Limited

URI: https://docs.ankatech.co/errors/crypto-playground-rate-limited
HTTP Status: 429 Too Many Requests

When you see this

This person sent too many Cryptographic Playground execution requests in the last minute, so nothing was run. The bound counts requests, not successful runs: per person within a tenant, over a sliding minute, 30 by default on each Admin API instance. Every request admitted past the tenant-type gate counts, including one refused afterwards (422, 409 or 503). A round trip counts as two requests and a migration test as two or three. A request refused by this bound does not move the window. The response carries Retry-After, the seconds until a request is admitted again.

Returned by POST /api/v3/admin/tenants/{tenantId}/crypto-playground/execute (executeCryptoPlaygroundOperation). The body is parsed and validated first: a malformed body (400) or one above the size limit (413) is refused before the bound and does not count. The bound is then checked right after the tenant and its type are admitted, before the leg is resolved, so no token is requested for the Actor and no audit record is written. Reading the flows does not count.

Common Causes

  • Running an operation, a round trip or a migration test repeatedly from the screen, or from a script over this endpoint.

Response Example

{
  "type": "https://docs.ankatech.co/errors/crypto-playground-rate-limited",
  "title": "Crypto Playground Rate Limited",
  "status": 429,
  "detail": "Too many Cryptographic Playground requests by this person in the last minute; nothing was run. Retry after the time the Retry-After header states.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/crypto-playground/execute",
  "extensions": {
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Wait the seconds Retry-After states and try again. Nothing was run, so the operation cannot have happened twice.
  2. A workload that needs to run operations at volume calls the cryptographic API directly under its own token. The Playground is a person's tool.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.