Rate limits

# --retry 5 makes curl honour Retry-After on a 429 by itself.
curl -sS --retry 5 --retry-all-errors \
  "https://api.salafems.com/ext/v1/orders?limit=100" \
  -H "Authorization: Bearer $SALAF_API_KEY" \
  -D headers.txt

# The headers on EVERY response tell you how much room is left:
#   X-RateLimit-Limit: 120
#   X-RateLimit-Remaining: 3
#   X-RateLimit-Reset: 1786521600
grep -i '^x-ratelimit' headers.txt

async function call(url, attempt = 0) {
  const response = await fetch(url, {
    headers: { Authorization: `Bearer ${process.env.SALAF_API_KEY}` },
  });

  if (response.status === 429 && attempt < 5) {
    // Retry-After is authoritative — it is the exact number of seconds
    // until this key's window resets. Guessing a backoff just means
    // retrying too early and burning another request on a 429.
    const wait = Number(response.headers.get("Retry-After") ?? 1);
    await new Promise((resolve) => setTimeout(resolve, wait * 1000));
    return call(url, attempt + 1);
  }

  if (!response.ok) {
    const { error } = await response.json();
    throw new Error(`${error.code}: ${error.message} [${error.request_id}]`);
  }

  return response.json();
}

import os
import time

import requests

HEADERS = {"Authorization": f"Bearer {os.environ['SALAF_API_KEY']}"}


def call(url, params=None, attempts=5):
    for attempt in range(attempts):
        response = requests.get(url, params=params, headers=HEADERS, timeout=30)

        if response.status_code == 429:
            # Retry-After is exact — it is the seconds left in this key's
            # fixed window. Sleeping less just spends another request.
            time.sleep(int(response.headers.get("Retry-After", "1")))
            continue

        if not response.ok:
            error = response.json()["error"]
            raise RuntimeError(f"{error['code']}: {error['message']}")

        return response.json()

    raise RuntimeError("Still rate limited after retrying.")

<?php

function call(string $url, int $attempts = 5): array
{
    $key = getenv('SALAF_API_KEY');

    for ($attempt = 0; $attempt < $attempts; $attempt++) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HEADER => true,
            CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $key],
            CURLOPT_TIMEOUT => 30,
        ]);
        $raw = curl_exec($ch);
        $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        curl_close($ch);

        $headers = substr($raw, 0, $headerSize);
        $payload = json_decode(substr($raw, $headerSize), true);

        if ($status === 429) {
            // Retry-After is the exact seconds left in the window.
            preg_match('/retry-after:\s*(\d+)/i', $headers, $m);
            sleep((int) ($m[1] ?? 1));
            continue;
        }

        if ($status >= 400) {
            throw new RuntimeException("{$payload['error']['code']}: {$payload['error']['message']}");
        }

        return $payload;
    }

    throw new RuntimeException('Still rate limited after retrying.');
}