Limits applied for you
Fóir caps how often a key can call the API and how large a single query can be, and it checks both before the query runs. The limits are documented and reported in response headers.
Request rate
Each API key has an hourly request allowance set by your plan. The allowance belongs to that key alone and is measured over a sliding 60 minutes. The unit is one HTTP request, however many records it returns, and a document that selects more than 5,000 fields is charged in proportion. Every response reports the limit, what remains and when it resets in its headers.
Over the limit
A refused request gets HTTP 429 with the code RATE_LIMITED and a Retry-After header. The typed SDK honours the header when it retries.
A read on the GraphQL endpoint that goes over the limit is answered from the response cache when a cached response for that exact request exists. It comes back as HTTP 200 with the header X-Foir-Stale: true. A read with nothing cached gets the 429.
Query size
Three caps are enforced on the parsed document before it executes: a maximum depth of 24, a maximum complexity of 10,000 selected fields and a maximum of 1,000 aliases. Complexity is a plain count. Each selected field counts as one, with no per-field weights and no multiplication for lists, and a union is charged for its largest member. The three caps are advertised in response headers too.
Concurrent requests
A workspace can have a few dozen requests running at once. One more than that is refused immediately with the same rate-limit code, without being queued.
Read the detail
The errors reference gives the rate limit for each plan, the response headers and the query limits.