Limits and errors

• 120 requests a minute per key, REST and MCP together, and 120 a minute per signed-in app. Over it, the answer is 429 with a Retry-After header in seconds.
• Up to 1,000 rows a page.
• An MCP request body of up to 64 KiB, or 256 KiB for a change tool from a signed-in app.

Every error is JSON: { "error": "..." }.

• 401: the key is missing, malformed, unknown or revoked, or the workspace's subscription does not currently allow access (for example, cancelled, or past due beyond its grace period).
• 403: a change tool called by an app that was not allowed to propose changes (insufficient_scope); sign in again and turn changes on.
• 404: no such route, or an entity the key cannot read. An account id that is not in the entity returns no rows rather than an error.
• 405: a method other than GET on the REST API, or other than POST on the MCP endpoint.
• 422: a parameter is invalid; the message names it.
• 413: an MCP request body is too large.
• 429: the rate limit; wait for Retry-After.
• 500: the request did not complete. Retry later.

The key and the rate limit are checked first, as HTTP 401 and 429. After that, errors are JSON-RPC: -32700 the body is not JSON, -32600 not a request, -32601 unknown method, -32602 an unknown tool or invalid arguments (with the REST message). A database failure is a tool result with isError set.

A change tool that 42six refuses (an expired plan, busy books, an ambiguous account, nothing to change) is a tool result with isError set whose text is JSON: { "error": "...", "error_description": "..." }, plus choices or exclusions where they apply.