Besides the general limits already applied to any request (per tenant, per user or per IP, depending on the
case), every request that includes the X-API-Key header gets an additional quota of its own for that
key: by default, 120 requests per minute. Exceeding it returns 429 (section 12) until the
following minute frees up quota again.
This quota applies as soon as the header is present, even if the key turns out to be invalid or revoked — that way a leaked key used to try random values also can’t hammer the server without limit.