| Surface | Limit (today) | Partition |
|---|---|---|
Public API (public-api policy) |
100 requests / minute | Client IP |
MCP (X-Coho-Api-Client only) |
100 requests / minute | User id, else IP |
| COHO → your app | Retries on 429 (honours Retry-After, capped at 60s); then dead-letter |
Per delivery |
There is no per-connection Atrium quota yet. Do not assume a private bucket. HTTP 429 from Public API should be retried with backoff, same as COHO retries 429 from you.
WAF/IP blocks on the public API hostname still apply. Auth endpoints and Find-a-Home enquiry limits are unrelated to Store apps.