## TL;DR

Posting hundreds of inline comments at once trips GitHub's secondary (abuse) rate limits. Submit one review containing all comments in a single API call, with delays between separate calls.

## Error

```text
403: You have exceeded a secondary rate limit. Please wait a few minutes before you try again.
```

## Steps

1. Confirm it is the secondary limit: the 403 message says 'secondary rate limit', not the primary quota. Expected: abuse detection, not quota exhaustion.
2. Batch the submission: send all inline comments in one 'create review' call instead of one call per comment. Expected: one API call instead of 200.
3. If multiple calls are unavoidable, space them out (a few seconds apart) and back off exponentially on 403. Expected: no secondary-limit trips.
4. Reduce comment volume anyway: consolidate low-severity nits into the review body. Expected: fewer calls and happier reviewers.

## When to use

- The agent gets secondary-rate-limit 403s while posting review comments.
- The agent posts many comments rapidly.

## When not to use

- Primary rate limit exhausted (X-RateLimit-Remaining: 0)  -  wait for reset or use a different token.
- The 403 is a permissions error, not a rate limit; check the message.

## Tool compatibility

- GitHub REST/GraphQL review APIs.
- Any bulk-commenting agent.

## Variant phrasings

### Secondary limits on other bulk operations

Same fix: batch, space out, back off  -  it applies to any write burst.

### Limits during business hours only

Shared tokens hit limits faster; consider a dedicated bot token.

## Why it happens

Secondary limits guard against abuse patterns like write bursts, independent of the hourly quota. Two hundred comment POSTs in seconds looks exactly like abuse, so the API throttles it even with quota remaining.

## Edge cases

- The single-review batch endpoint is the intended path for bulk comments  -  use it by design, not as a workaround.
- Exponential backoff with jitter prevents a fleet of agents from retrying in lockstep.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_53ydD-xJcwPaktSnA3WFfQ