Most API endpoints are rate limited, per user or per IP address depending on the endpoint. That's been true for a while — you just had to find out by running into one.
Every endpoint reference page now has a Rate limit section with its own limit, and there's a summary on the REST API overview. Go over it and you'll get a 429 with a Retry-After header telling you how long to wait.
We also tightened the limits on the AI and email endpoints, and loosened them on the student-facing ones — a whole class taking a test from one school building shares a single IP address, and that shouldn't look like abuse.