The de facto rate-limit family, declared by 96 providers against 27 for the RFC-track alternative.
X-RateLimit-Limit
Rate Limiting & Quota de facto — unregistered response 4 spellings
The X-RateLimit-* family — Limit, Remaining, Reset — is how most of the API economy reports quota state. It has no specification. It emerged from GitHub and Twitter in the early 2010s and spread by imitation, which is why the reset value is sometimes a Unix timestamp, sometimes seconds-until-reset, and occasionally an ISO date, with nothing in the response to say which.
The IETF work that became the RateLimit-* fields exists to fix exactly that. In this catalog it is declared by 27 providers against 96 for the X- family. The de facto standard is winning roughly three and a half to one, and any honest measurement of the market has to count both.
The registry
Not registered with IANA. It is a de facto or vendor field — real, widely used, and governed by nothing but convention.
In the catalog
Declared by 95 providers across 5,408 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.
It is spelled 4 different ways across those contracts — X-RateLimit-Limit, x-ratelimit-limit, x-RateLimit-Limit, X-Ratelimit-Limit. HTTP field names are case-insensitive (RFC 9110, §5.1), so every one of these is the same header. They are not the same string, which is why generated clients disagree about it.
Using it
If you already ship X-RateLimit-*, keep shipping it and add the standard RateLimit-* fields alongside — they cost nothing and they are where the ecosystem is going. Whichever you send, document the units of the reset value in your contract. A client that has to guess whether Reset is an epoch or a duration will guess wrong half the time.
Send these on successful responses too, not only on the 429. The point is to let a caller slow down before it hits the wall.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Rate Limit Error error
Utilizing centralized headers rate limits allows you to reuse headers across all API requests and responses, enabling a more organized approach to handling the transport and rate limits applied consistently across all...
Guidance: Rate Limits →OpenAPI Components Headers Rate Limit Info info
Utilizing centralized headers rate limits allows you to reuse headers across all API requests and responses, enabling a more organized approach to handling the transport and rate limits applied consistently across all...
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →OpenAPI Response RateLimit Headers error
API responses must include the standard rate limit header trio (ratelimit-limit, ratelimit-remaining, ratelimit-reset) to inform consumers of their current usage against rate limits.
Guidance: Errors →