429 Too Many Requests
You hit a rate limit.
What it means
The client sent too many requests in a time window. Retry-After, or RateLimit headers, say when to try again.
What your client should do
Wait for Retry-After before retrying. Use exponential backoff with jitter, and lower your request rate.
Should you retry?
Yes, after the delay in the Retry-After header. Without it, back off exponentially with jitter.
Security angle
Rate limits defend against brute force and resource exhaustion (OWASP API4).
Try it
The free practice API returns this status on demand, with the headers a well-behaved API would send. Call GET /api/play/status/429 from Endpoint Client and open the Explain tab.
Related codes
Defined in RFC 6585. All status codes and headers