# Errors and limits

Status codes, error bodies and rate limits for the REST API and MCP server.

Errors are JSON: `{ "error": "A sentence saying what's wrong and what to do." }`. On the MCP server, authentication errors are JSON-RPC errors (code `-32001`), and everything else comes back as a tool result with `isError: true`.

| Status       | Meaning                                                                                            |
| ------------ | -------------------------------------------------------------------------------------------------- |
| `400`        | Invalid body or ID (the message says which field)                                                  |
| `401`        | Missing, malformed, invalid, revoked or expired key or token; or a sign-in token used on `/api/v1` |
| `403`        | Not allowed: missing scope, or publishing not allowed (the message says which)                     |
| `404`        | No such tour or tooltip in this project                                                            |
| `409`        | Review requested for something already live                                                        |
| `429`        | Rate limited, or a review was already requested within the hour. See `Retry-After`                 |
| `500`, `502` | Something failed on our side; safe to retry                                                        |

## Rate limit

**60 requests per minute** per key or signed-in agent, in fixed one-minute windows. Over the limit, requests answer `429` with `Retry-After` (seconds to the next window). Create a tour with all its steps in one request rather than one request per step.

## Size limits

Tours: up to 200 steps; titles 3–200 characters; step text up to 20,000 characters. Tooltips: text up to 5,000 characters. Selectors up to 4,000 characters. See the [REST API](/docs/reference/rest-api) for every field.