# Repete 429, 500 e 503 em até 5 tentativas; respeita Retry-After quando vem.
for attempt in 0 1 2 3 4; do
  status=$(curl -sS -o response.json -D headers.txt -w '%{http_code}' \
    -H "Authorization: Bearer $ZOUTI_API_KEY" \
    "https://api.zouti.com.br/v1/orders?limit=10")
  case "$status" in 429|500|503) ;; *) break ;; esac
  [ "$attempt" -eq 4 ] && break
  wait=$(grep -i '^retry-after:' headers.txt | tr -dc '0-9')
  [ -n "$wait" ] || wait=$(awk -v n="$attempt" 'BEGIN { srand(); w = 0.5 * 2 ^ n; if (w > 30) w = 30; printf "%.3f", w + rand() * 0.25 }')
  sleep "$wait"
done
echo "HTTP $status"
cat response.json

// Node.js 18+ (fetch nativo). Repete 429, 500 e 503 em até 5 tentativas.
const API_KEY = process.env.ZOUTI_API_KEY;
const BASE_URL = 'https://api.zouti.com.br';
const RETRYABLE = new Set([429, 500, 503]);
const MAX_ATTEMPTS = 5;

class ZoutiError extends Error {
  constructor(status, body, requestId) {
    super(body?.error?.message ?? `HTTP ${status}`);
    this.status = status;
    this.code = body?.error?.code ?? null; // o 429 do limite por IP vem sem corpo
    this.requestId = requestId;
  }
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

function waitMs(response, attempt) {
  const retryAfter = Number(response.headers.get('Retry-After'));
  if (retryAfter > 0) return retryAfter * 1000;
  return Math.min(30, 0.5 * 2 ** attempt) * 1000 + Math.random() * 250;
}

async function zoutiGet(path) {
  for (let attempt = 0; ; attempt++) {
    const response = await fetch(`${BASE_URL}${path}`, {
      headers: { Authorization: `Bearer ${API_KEY}` },
    });
    if (response.ok) return response.json();

    const body = await response.json().catch(() => null);
    if (!RETRYABLE.has(response.status) || attempt + 1 >= MAX_ATTEMPTS) {
      throw new ZoutiError(response.status, body, response.headers.get('Request-Id'));
    }
    await sleep(waitMs(response, attempt));
  }
}

const page = await zoutiGet('/v1/orders?limit=10');
console.log(`${page.data.length} pedidos; has_more: ${page.has_more}`);

# Python 3 com requests. Repete 429, 500 e 503 em até 5 tentativas.
import os
import random
import time

import requests

API_KEY = os.environ["ZOUTI_API_KEY"]
BASE_URL = "https://api.zouti.com.br"
RETRYABLE = {429, 500, 503}
MAX_ATTEMPTS = 5


class ZoutiError(Exception):
    def __init__(self, response):
        try:
            error = response.json().get("error", {})
        except ValueError:
            error = {}  # o 429 do limite por IP vem sem corpo JSON
        super().__init__(error.get("message", f"HTTP {response.status_code}"))
        self.status = response.status_code
        self.code = error.get("code")
        self.request_id = response.headers.get("Request-Id")


def wait_seconds(response, attempt):
    retry_after = response.headers.get("Retry-After", "")
    if retry_after.isdigit() and int(retry_after) > 0:
        return int(retry_after)
    return min(30, 0.5 * 2**attempt) + random.uniform(0, 0.25)


def zouti_get(path, params=None):
    for attempt in range(MAX_ATTEMPTS):
        response = requests.get(
            f"{BASE_URL}{path}",
            params=params,
            headers={"Authorization": f"Bearer {API_KEY}"},
            timeout=30,
        )
        if response.ok:
            return response.json()
        if response.status_code not in RETRYABLE or attempt + 1 == MAX_ATTEMPTS:
            raise ZoutiError(response)
        time.sleep(wait_seconds(response, attempt))


page = zouti_get("/v1/orders", {"limit": 10})
print(f"{len(page['data'])} pedidos; has_more: {page['has_more']}")

<?php
// PHP 7.4+ com a extensão curl. Repete 429, 500 e 503 em até 5 tentativas.
const BASE_URL = 'https://api.zouti.com.br';
const RETRYABLE = [429, 500, 503];
const MAX_ATTEMPTS = 5;

function zouti_get(string $path): array
{
    $apiKey = getenv('ZOUTI_API_KEY');
    for ($attempt = 0; ; $attempt++) {
        $headers = [];
        $ch = curl_init(BASE_URL . $path);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => 30,
            CURLOPT_HTTPHEADER => ["Authorization: Bearer {$apiKey}"],
            CURLOPT_HEADERFUNCTION => function ($ch, $line) use (&$headers) {
                $parts = explode(':', $line, 2);
                if (count($parts) === 2) {
                    $headers[strtolower(trim($parts[0]))] = trim($parts[1]);
                }
                return strlen($line);
            },
        ]);
        $body = curl_exec($ch);
        if ($body === false) {
            throw new RuntimeException(curl_error($ch));
        }
        $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

        if ($status >= 200 && $status < 300) {
            return json_decode($body, true);
        }
        if (!in_array($status, RETRYABLE, true) || $attempt + 1 >= MAX_ATTEMPTS) {
            $error = json_decode($body, true)['error'] ?? []; // o 429 do limite por IP vem sem corpo
            throw new RuntimeException(sprintf(
                'HTTP %d %s (Request-Id %s)',
                $status,
                $error['code'] ?? '',
                $headers['request-id'] ?? '-'
            ));
        }
        $retryAfter = (int) ($headers['retry-after'] ?? 0);
        $wait = $retryAfter > 0 ? $retryAfter : min(30, 0.5 * 2 ** $attempt) + mt_rand(0, 250) / 1000;
        usleep((int) ($wait * 1000000));
    }
}

$page = zouti_get('/v1/orders?limit=10');
printf("%d pedidos; has_more: %s\n", count($page['data']), $page['has_more'] ? 'true' : 'false');

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_request",
    "message": "O parâmetro limit é inválido.",
    "param": "limit",
    "request_id": "req_8f2kq1x7c3m9v4b6n0zd5a"
  }
}

{
  "error": {
    "type": "rate_limit_error",
    "code": "rate_limited",
    "message": "Limite de requisições excedido. Tente novamente em instantes.",
    "request_id": "req_8f2kq1x7c3m9v4b6n0zd5a"
  }
}