IIRC 10C returns 200 OK with an empty data when you get ratelimited. You can look at the x-ratelimit headers to see how many you have left and when they reset. Logged-in requests get 5k per hour, unauth'd are only 500 per hour. (You really want to get auth working.)