Rate limits

Successful calls aren’t throttled. Every limit applies to failures.

Presenting an API key

Ten refused key presentations in five minutes start an escalating lockout: 5 seconds, then 30, then 2 minutes, then 10, with Retry-After on the 429. Lockouts are keyed on the calling peer, and a token that verifies clears the count.

Typing an arming code

A code is six keypresses on the box’s four keys. Five failed attempts in ten minutes lock a box for 30 seconds, then 2 minutes, 10, then 30. A quiet spell resets the count.

Nothing here touches your service. No endpoint returns a code.