Limits and plans

New accounts start on the Developer plan. The plan belongs to the account (user), not to a key.

Plan	Per minute	Per month	Active keys	Key lifetime	OAuth connection	Production	Endpoints
Developer (`developer`)	20	100	1	30 days	30 days	no — development and testing only	all
Starter (`starter`)	60	15 000	3	no expiry	while used (90 days idle)	yes	all
Pro (`pro`)	150	75 000	5	no expiry	while used (90 days idle)	yes	all
Business (`business`)	300	300 000	10	no expiry	while used (90 days idle)	yes	all

The Developer plan is for development and testing only. Commercial products and public services need a paid plan (terms, in Azerbaijani). To change plans, write to api@huqsi.az with your e-mail and purpose. A change applies at once to all your keys and connected apps.

Limits belong to the account

Per-minute limit (rpm): requests in a sliding 60-second window. Exceeding it returns 429 rate_limited with Retry-After (seconds).
Monthly quota: requests per calendar month (UTC). Exceeding it returns 429 quota_exceeded. The quota resets on the 1st.
Both limits are shared by all your API keys and OAuth connections. Revoking a key and creating a new one does not reset the counter.

Per-IP ceiling

At most 360 requests per minute are accepted from one IP address, whatever the key or account. Exceeding it returns 429 ip_rate_limited.

API key lifetime

On plans with a key lifetime (see the table), a key stops working a fixed number of days after it was created or renewed and returns 401 key_expired. The dashboard shows the date and a «Renew» button. One click extends the same key.

OAuth connections (Claude.ai, ChatGPT …)

Access tokens live 60 minutes. The client renews them with a refresh token, which you do not notice.
Developer: the connection works for 30 days after «Connect», then the client asks you to connect again (the counterpart of the key lifetime).
Starter, Pro, Business: the connection stays active while it is used and ends after 90 days without use.
At most 10 active connections per account, separate from the key limit. Revoke a connection under «Connected apps» in the dashboard.
Rules are taken from the account's current plan: after an upgrade, existing connections follow the new plan immediately.

What counts

REST: every authenticated /v1/* request counts, whatever the status code (404 and 422 too). These do not count:
401;
403 and all 429 responses;
503: when the law database does not answer, the request is refunded.
MCP: only tool calls count. initialize and tools/list are free.

Response size

POST /v1/search returns a passage per hit (snippet, at most 600 characters), not the full text.
GET /v1/articles/{id} returns at most 100 000 characters. Longer texts are cut at a sentence boundary: you get truncated: true and the full length in text_length.
MCP: passage 600, article 30 000 characters.

Headers

Every /v1 and /mcp response carries X-Plan: <plan>. /v1 responses also carry X-RateLimit-* headers (per-minute and monthly remaining, per account).