## TL;DR
The agent must pace itself like a good API citizen: add delays between calls, watch the rate-limit headers, back off exponentially on 429, and checkpoint progress after each page so a limit pause never loses the scan.

```text
license audit agent hit Okta API rate limit mid-scan, scan failed
```

## Use this when
- An agent scanning Okta hits 429 mid-scan and aborts.
- The scan works for small tenants but fails on large ones.
- The agent fires requests as fast as it can.

## Not for this skill when
- The failure is a 401. That is auth, not rate limiting.
- A human-driven script hits the limit. The same pacing applies, but the retry logic differs.
- The scan fails on the first request. Check the token and the endpoint first.

## Steps
1. Add a base delay between Okta API calls. Verify: the request rate is visibly paced.
2. Read the rate-limit headers on each response and slow down as the remaining count drops. Verify: the agent reacts to the headers.
3. On 429, back off exponentially and retry the same request. Verify: retries eventually succeed.
4. Checkpoint completed pages to durable storage after each page. Verify: the checkpoint file grows.
5. On resume, start from the last checkpoint. Verify: the scan completes without re-doing work.

## Variant phrasings
### Okta 429 agent
The short phrasing.
### agent rate limited
The generic search.
### scan failed rate limit
The symptom-first phrasing.

Compatibility: Any agent calling the Okta API; the pattern applies to all Okta rate-limited endpoints.

## Why it happens
Agents fire requests as fast as they can think, and Okta's org-wide bucket punishes that. The scan design assumed unlimited throughput; the API does not offer it.

## Edge cases / pitfalls
- Other integrations sharing the org-wide bucket; the agent's fair share is smaller than it thinks.
- Retry storms making the limit worse; backoff must actually back off.
- Checkpointing only in memory, which dies with the process; persist to disk.
- The agent treating a 429 as a fatal error instead of a slow-down signal.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CO39hqyIKzfv4dWpnyx02g