5 of 35 APIs sent a rate-limit header on errors

More of the APIs that answered our bad requests replied in JSON every time than sent a rate-limit header.

The numbers

As of 31 October 2026: from the drives of 193 products, 1 to 31 October 2026. Each one links to its definition and evidence. A product can count in more than one row.

By AgentDrivesPublished 1 November 2026193 products, driven 1 Oct to 31 Oct2 min readFor agents Markdown

14%, 5 of 35: Sent a rate-limit header.

Share this card: Wide PNG · Tall PNG

As of 31 October 2026, 5 of 35 products whose API answered our bad requests on 25 October 2026 sent a rate-limit header (RateLimit, X-RateLimit-* or Retry-After). An agent builder can’t count on a rate-limit header in an API’s error answer. The count covers the headers on those error answers only, not other responses from the same APIs, nor the rest of the 193 products we drove.

X-RateLimit-* headers outnumbered the IETF RateLimit fields

Of the products whose API answered our bad requests, 4 of 35 sent X-RateLimit-* headers, at GitHub, Make, Nifty and SignWell. Each count here comes from the bad requests we sent to the APIs on 25 October 2026, and says what came back, not why.

The IETF RateLimit header fields came back at 1 of 35 products, at Fillout. The error answers at Fillout, GitHub, Make, Nifty and SignWell also said how many requests were left.

On these error answers, a client reading only X-RateLimit-* names misses Fillout’s header, and a client reading only the IETF fields misses the headers of GitHub, Make, Nifty and SignWell.

On recordFilloutFormsL4Runs on its ownGot in; reaches the checkoutProduct page

JSON errors outnumbered web-page errors

21 of 35 products whose API answered our bad requests replied to each of them in JSON.

60%, 21 of 35: APIs that answered each bad request in JSON.

Share this card: Wide PNG · Tall PNG

As of 31 Oct 2026: our drives of 193 products, 1–31 Oct 2026 · Today's numbers

Data table
ProductsOut ofShare
APIs that answered each bad request in JSON213560%

At 8 of 35, a bad request got a web page instead of an API error. An agent reading that answer got markup where it looked for an error message it could parse.

Fillout, GitHub and Nifty answered in JSON and also sent a rate-limit header, so an owner has those error answers to set beside their own.

11 of 35 products named what was wrong in every answer

At Attio, Brevo, Canva, Firecrawl, Notion, Postiz, Resend, Steel, Tinybird, Twenty and UploadThing, the error answers carried no rate-limit header. Steel aside, that list’s error answers all came in JSON. Without a key, UploadThing’s API answered “Missing API Key” and Resend’s answered missing_api_key. Twenty’s documented key endpoint told API-key callers “This endpoint is not available to this caller”.

Across the products whose API answered our bad requests, 33 of 35 named what was wrong in an answer, a wider group than the products above. Nifty’s API answered a project create on a new workspace with an error asking for portfolioId.

16 of 35 products whose API answered our bad requests gave a request id with an error, and 7 of 35 linked to their docs in an error.

46%, 16 of 35: APIs that gave a request id with an error.

Share this card: Wide PNG · Tall PNG

As of 31 Oct 2026: our drives of 193 products, 1–31 Oct 2026 · Today's numbers

Data table
ProductsOut ofShare
APIs that gave a request id with an error163546%

GitHub is on the docs-link list but not the request-id list; Make and SignWell are on the request-id list as well as the header list.

For an owner comparing their own error answers, Nifty’s carried JSON on every bad request, X-RateLimit-* headers, a request id and a docs link. Steel and Tinybird named the fault in every answer, and each gave a request id and linked its docs in an error.

Where our agent stopped in each.

10 products in this data story, by level.

  • FilloutForms
    • Find Docs it can act on
    • Get in Sign-up in a browser
    • Use 80% of the work
    • Pay Reaches the checkout
    • Leave Leaves on its own
    L4Runs on its ownDriven 22 Oct 2026
  • NiftyProject management
    • Find Docs it can act on
    • Get in MCP sign-in
    • Use 100% of the work
    • Pay Reaches the checkout
    • Leave Leaves on its own
    L4Runs on its ownDriven 28 Oct 2026
  • SignWellE-signature
    • Find Docs it can act on
    • Get in Sign-up in a browser
    • Use 100% of the work
    • Pay Card checkout
    • Leave Leaves on its own
    L4Runs on its ownDriven 6 Oct 2026
  • SteelBrowser infrastructure
    • Find Docs it can act on
    • Get in Pay per call, sign-up in a browser
    • Use 100% of the work
    • Pay Pays per call for part of it
    • Leave Nothing to cancel; deletes its data, but the login stays
    L4Runs on its ownDriven 12 Oct 2026
  • TwentyCRM
    • Find Docs it can act on
    • Get in MCP sign-in, sign-up in a browser
    • Use 90% of the work
    • Pay Reaches the checkout
    • Leave Leaves on its own
    L4Runs on its ownDriven 27 Oct 2026
  • GitHubSource control
    • Find Docs it can act on: yes.
    • Get in Can't sign up: no.
    • Use Work not reached: not reached.
    • Pay Payment not reached: not reached.
    • Leave Leaving not reached: not reached.
    Can't sign up on its own: a bot check stops it
    L1Needs a personDriven 27 Oct 2026
  • MakeAutomation
    • Find Docs it can act on: yes.
    • Get in Signs up sometimes: partly.
    • Use Work not reached: not reached.
    • Pay Reaches the checkout: partly.
    • Leave Leaves on its own: yes.
    Gets in on 1 of the last 3 drives
    L1Needs a personDriven 24 Oct 2026
  • ResendEmail infrastructure
    • Find Docs it can act on: yes.
    • Get in Can't sign up: no.
    • Use Work not reached: not reached.
    • Pay Payment not reached: not reached.
    • Leave Leaving not reached: not reached.
    Can't sign up on its own: a bot check stops it
    L1Needs a personDriven 19 Oct 2026
The other 2 products
  • TinybirdData warehousesself-hosted: L4
    • Find Docs it can act on: yes.
    • Get in Can't sign up: no.
    • Use Work not reached: not reached.
    • Pay Payment not reached: not reached.
    • Leave Leaving not reached: not reached.
    Can't sign up on its own: a bot check stops it
    L1Needs a personDriven 27 Oct 2026
  • UploadThingFile storage
    • Find Docs it can act on: yes.
    • Get in Can't sign up: no.
    • Use Work not reached: not reached.
    • Pay Payment not reached: not reached.
    • Leave Leaving not reached: not reached.
    Can't sign up on its ownSign-up only through GitHub
    L1Needs a personDriven 24 Oct 2026

See what an agent sees in yours.

Free: what an agent finds, any wall in its way and how many things to fix. The Audit ($499) gives you every fix.

Method and limits.

Products
193
Driven
1 to 31 October 2026
Numbers
Each one links to its definition and the products behind it.
Limits
Cloudflare has listed our agent as a signed agent since 24 October 2026. Drives before 24 October 2026 ran signed but unlisted: a check could see the signature but had no listed identity to trust. No other bot-check provider lists it yet.

Every number, with its productsHow we drive and score

Written with AI from these drives.

Asked about this data story.

2 questions
How many products' API docs did we read for their error format?

We read the API docs of 132 of 193 products we drove for their error format. The counts in this piece come from what the APIs answered, not from those docs.

How fast does our agent send requests to a product?

The pace our agent keeps is one drive per product at a time, at a person's pace (about one page action every few seconds); up to three drives at once across different products, about a hundred a day. Before a drive it reads the product's public docs one page at a time, at most one a second per host, or slower when robots.txt asks a Crawl-delay. A drive may send one short burst of 10–20 calls to one endpoint to check rate limiting, and stops at the first 429. [How we drive](/method) has the rest.

Cite this

AgentDrives. “5 of 35 APIs sent a rate-limit header on errors.” 1 November 2026. agentdrives.com/research/5-of-35-products-whose-api-sent-a-rate-limit-header

Drive data is CC BY 4.0. The text as Markdown. Every fact with its evidence.

More from the drives.