AltF Developers

Rate limits, 429s and caching

Two endpoints are rate limited per client: /api/signals at 60 requests a minute and /api/health at 30. Going over returns HTTP 429 with Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers. Every endpoint sends a Cache-Control header; caching for that long keeps you far below the limits. The backoff generator above writes retry code that honours Retry-After.

No API key
Free, no sign-up
Real responses, no mock data
Code in 5 languages

Retry and backoff code

Generate client code that waits for Retry-After on a 429 and backs off on server errors, so your app never hammers an endpoint.

Endpoint

Limit: 60 requests per minute per client.

Max retries(3)

Base delay(1000 ms)

Waits on 5xx / network errors

Retry 11s+
Retry 22s+
Retry 34s+

On a 429 the code waits for the Retry-After value instead. 400 and 404 are never retried.

async function getJson(url = "https://www.altftool.com/api/signals", maxRetries = 3, baseDelayMs = 1000) {
  for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
    let response = null;
    try {
      response = await fetch(url, { headers: { Accept: "application/json" } });
    } catch {
      response = null; // network error: retry with backoff
    }
    if (response?.ok) return response.json();
    let delay;
    if (response?.status === 429) {
      const retryAfter = Number(response.headers.get("retry-after"));
      delay = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000 : baseDelayMs * 2 ** attempt;
    } else if (!response || response.status >= 500) {
      delay = baseDelayMs * 2 ** attempt + Math.random() * baseDelayMs;
    } else {
      throw new Error(`HTTP ${response.status}`); // 400/404: do not retry
    }
    if (attempt === maxRetries) throw new Error("Gave up after retries");
    await new Promise((resolve) => setTimeout(resolve, delay));
  }
}

What a 429 looks like

Status 429, body {"error": "Too many requests. Please try again shortly."}, and headers Retry-After (seconds), X-RateLimit-Limit, X-RateLimit-Remaining: 0 and X-RateLimit-Reset (Unix seconds). It is sent with Cache-Control: no-store.

A good retry policy

On 429, sleep for Retry-After seconds, then retry once.
On 5xx or a network error, retry with exponential backoff (1s, 2s, 4s) plus jitter, at most 3-4 times.
Never retry 400 or 404: the request itself is wrong.
Cache successful responses for their max-age or s-maxage.

Limits, CORS and caching

AltFTool public endpoints with CORS, rate limit and caching
Endpoint	Returns	Browser CORS	Rate limit	Cache
GET /api/signals	Signals catalogue	Same origin only	60 requests per minute per client	CDN 1 hour, then stale for up to 24 hours
GET /api/open-data/exam-photo-specs	Exam photo and signature specs	Any origin (Access-Control-Allow-Origin: *)	No per-client limit; served from cache	Browser and CDN 24 hours, stale for up to 7 days
GET /api/open-data/transform-converters	Format converter index	Any origin (Access-Control-Allow-Origin: *)	No per-client limit; served from cache	Browser and CDN 24 hours, stale for up to 7 days
GET /api/oembed	oEmbed provider	Any origin (Access-Control-Allow-Origin: *)	No per-client limit; cached at the CDN	CDN 1 hour, then stale for up to 24 hours; cache_age 86400
GET /api/health	Site health	Same origin only	30 requests per minute per client	CDN 60 seconds, then stale for up to 2 minutes

Read from each route's source code on 2026-11-01.