Edge safety limits: rate headers, body-size errors, pre-auth throttling
Edge safety limits: rate headers, body-size errors, pre-auth throttling
A set of edge-safety changes make API failures easier to predict.
Rate-budget headers
Rate-limited routes now expose budget headers for the two axes that matter — request rate and concurrency / active-call capacity. If a client is near a ceiling, it shows up in the response instead of surfacing as a 429 you have to attribute to a bucket. Use it for backoff, dashboards, and customer-facing diagnostics.
Body-size and content-type errors
Large JSON bodies share one decode path. A body that is too large returns 413; a request with an unsupported media type returns 415. Both use the standard Speechify error envelope with request_id. Upload routes that expect large multipart bodies (voice-clone samples, knowledge-base documents) keep route-specific overrides.
Pre-auth throttling
Token-mint endpoints now have an IP-level limiter before auth runs, protecting the credential-exchange path from unauthenticated bursts. It leaves headroom for normal enterprise NAT setups, with a config lever for unusually large networks.