onenote-rate-limits

# OneNote — Rate Limit Handling & Request Throttling ## Overview Microsoft Graph rate limits OneNote at **600 requests per 60 seconds per user** and **10,000 requests per 10 minutes per app/tenant**. When you exceed either limit, the API returns `429 Too Many Requests` with a `Retry-After` header specifying how many seconds to wait. Most implementations either ignore this header entirely (retrying immediately, making things worse) or use a fixed backoff that wastes capacity. This skill implements a token bucket rate limiter, queue-based request throttling, and proper `Retry-After` header parsing. For multi-user apps, it tracks per-user and per-tenant budgets independently. Key pain points addressed: - The `Retry-After` header value is in seconds (not milliseconds) — many implementations parse this wrong - The per-user limit (600/60s) is separate from the per-tenant limit (10,000/10min) — you can hit one without the other - Batch requests (`$batch`) count as one request toward the limit, regardless of how many operations are inside - After a 429, subsequent requests to ANY OneNote endpoint are throttled — not just the endpoint that triggered it ## Prerequisites - Azure app registration with delegated permissions: `Notes.ReadWrite` - App-only auth deprecated March 31, 2025 — use delegated auth only - Python: `pip install msgraph-sdk azure-identity` - Node/TypeScript: `npm install @microsoft/microsoft-graph-client @azure/identity @azure/msal-node` - Optional: `npm install ...