# Fix: API responses advertise rate-limit headers

> Web-audit fix skill for the `rate-limit-headers` check (API, SHOULD).

## Goal

Advertise remaining quota on API responses so agents can back off instead of retrying blindly.

## Fix

Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or
the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`.
Without them an agent has no budget and will retry until it is locked out.

## Resources

- [IETF RateLimit header draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Advertise remaining quota on API responses so agents can back off instead of retrying blindly
Fix: Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`. Without them an agent has no budget and will retry until it is locked out.
Skill: https://anc.dev/fix/rate-limit-headers
Docs: https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `rate-limit-headers` check should report `pass`.