DraftKings API errors and rate limits

The error envelope

Errors return JSON with a numeric code and a message. Validation failures can add details. Log the status and message, and never the Authorization header.

{"error":{"code":429,"message":"Account request limit reached"}}

{"error":{"code":400,"message":"Invalid input","details":["..."]}}

What each status means

Each status has one sensible response. Retrying is only right for two of them.

Plan limits

Free includes 500 requests/month at 20/minute; Developer is $49/month with 10,000 requests/month at 60/minute; Production is $149/month with 50,000 requests/month at 120/minute. Limits apply to the account, shared across every key. Existing legacy accounts keep their original daily terms, and the dashboard shows your active contract.

What counts as a request

One authenticated API call is one request, whatever its page size. Authentication runs first, so these all count: empty results, a dataset returning 503, and invalid queries that passed authentication.

• Each stream connection counts as one request, and connections last up to 55 seconds.
• Each stream snapshot counts as one request.
• A failed key check does not reach your account, because the key was not recognized.
• /api/health and /api/openapi are public and need no key.

When limits reset

The two limits work on different clocks. Both use UTC, and neither follows your invoice date. Requests do not roll over.

The 429 message does not say which limit you reached, and responses carry no rate-limit or remaining-quota headers. Check the dashboard for current usage. A simple rule works in code: on a first 429, sleep to the next UTC minute and try once. If it fails again, stop the job and alert yourself.

Retry logic that respects quota

Retry 503 and network failures a few times with exponential backoff. Handle 429 by waiting for a boundary. Every other status needs a code or account change, so retrying only spends requests.

import time
from datetime import datetime, timezone

def seconds_to_next_minute():
    now = datetime.now(timezone.utc)
    return 60 - now.second + 1

def fetch_with_policy(call):
    limited = False
    for attempt in range(1, 4):
        status, body = call()
        if status < 400:
            return body
        if status == 429 and not limited:
            limited = True
            time.sleep(seconds_to_next_minute())
            continue
        if status == 503 and attempt < 3:
            time.sleep(2 ** attempt)
            continue
        raise RuntimeError(f"{status}: {body['error']['message']}")
    raise RuntimeError("Gave up after retries")

Do not bypass a denial

A 403 on DFS or a delivery feature is a real boundary. Do not change hosts, share keys between accounts or scrape the source as a fallback. A 503 is not permission to invent data: return an explicit unavailable state to your own users, with the last observed_at you hold.

Check the recorded data

• Sources and status

Related resources