[Resolved] CoW API not working (/quote)

Technical
1

Hi, I believe I have been rate-limited. I am building my custom 1min chart for popular assets like BTC, ETH, USDC etc.

Sample request:
```
curl -s -X POST ``https://api.cow.fi/base/api/v1/quote`` -H "Content-Type: application/json" -d '{
"sellToken": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"buyToken": "0x4200000000000000000000000000000000000006",
"from": "0x000000000000000000000000000000000000dEaD",
"appData": "{"version":"1.0.0","metadata":{}}",
"appDataHash": "0x1de4b8db5e0d8f8f6b7d6b0e4a9c6f8f3f7c8f3a1c8f3a1c8f3a1c8f3a1c8f3a",
"kind": "sell",
"sellAmountBeforeFee": "1000000",
"validFor": 120,
"priceQuality": "verified",
"signingScheme": "eip712"
}'
```

returns a bad response:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Request blocked.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: eiYbAG6TxMJci824L-s8HsiyI0Vv_qS0FbbFidIlP8Ua4g11pV7fxA==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>

A simple (Number of requests sent from my IP [182.177.51.15] vs Allowed number of requests) would suffice for a resolution.

Update: I found it: API Integration | CoW Protocol Documentation

Argh, just realized it wasn’t my 1min chart. I was viewing liquidities of various tokens on the website itself: CoW Swap | The smartest way to trade cryptocurrencies
maybe I was too fast :stuck_out_tongue:

Sorry, can I get passed one-time?

Thanks anyway.

[Resolved] see reply.

2

Resolved (1 hour cooldown passed).

3

Glad to hear it’s resolved! Let us know if there are any more issues.

1 Like
4

Hey @moo_keeper yeah there is one more issue, either the doc is outdated or someone forgot to add that there is more criteria of exceeding the rate limit on the API: API Integration | CoW Protocol Documentation

From what I’ve tested, it’s an undocumented hour based rule as well that blacklists a user for exceeding the rate limit. Likely something like:

number of requests during last hour > 1000 or 1500

I can confirm this is happening. Can you get the doc updated?

6

Hey @duahxn, thanks for digging into this further and for the detailed testing.

To clarify: there isn’t a separate undocumented hourly rule. The limit is 1500 requests per 5-minute rolling window for /quote. If you burn through the 1500 requests very quickly (say, within 1 minute), you’ll get blocked, but you only need to wait about 1 minute, not the full 5 - because once that minute passes, the rolling window looking back 5 minutes effectively sees 0 requests again (the burst has aged out of the window).

Separately, there are other layers that try to detect bot-like or spam-like request patterns before the numeric limit is even hit, which may also be a factor given the request pace you described.

So the short answer: this is rate limiting due to request volume/pace, not a hidden hourly cap.

In the meantime, spacing out request bursts should keep you clear of both layers.

1 Like
7

Thanks for the quick response @moo_keeper .

In that case, I am probably hitting the other layer, i.e. bot-like / spam-like request patterns.

However I feel the layer is being overly strict. Here is what my requests look like:

13 tokens total
2 requests (buy_quote and sell_quote) per minute for every token.
13 x 2 = 26 requests in 1 minute.
26 x 5 = 130 requests in 5 minutes.

I am not even getting close to the numeric limit layer.

I guess the security sorting is: extra-secure layer (bot-like detection) -> numeric limit layer ?

Shouldn’t it be numerical limits -> other layers ?

8

Hey @duahxn, without a bit more detail we can’t say for sure what triggered the block - feel free to DM, preferably on Discord, if you’d like to share more and we can take a look.

That said, these endpoints exist to protect our ability to serve users actually executing trades, so the limits on quoting and similar endpoints are intentionally strict, and that’s not something we’re looking to change at this moment.

1 Like
9

Hey @moo_keeper thanks for the support. I reduced my calls by 5x, it has been working good, dont need 1min granularity at the moment so it’s all good for now.

1 Like