It’s not great, but you could add it to the body of a 429 response.

Genuinely curious: do programs read bodies of 429 responses? In the code bases that I have seen, 429 is not read beyond the code itself

Sometimes! The server can also send a retry-after header to indicate when the client is allowed to request the resource again: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

… which isn't part of the body of a 429…

	▲	VTimofeenko 3 hours ago \| parent [-]
		Well, to be fair, I did say "is not read beyond the code itself", header is not the code, so retry-after is a perfectly valid answer. I vaguely remember reading about it, but I don't recall seeing it used in practice. MDN link shows that Chrome derivatives support that header though, which makes it pretty darn widespread

gleenn 4 hours ago | parent | prev [-]

Almost certainly not by default, certainly not in any of the http libs I have used