Queries do not need to be from tag owner account?

[alfs]

If I understand correctly, the location reports can be requested by any apple account, it doesn't have to be the account that owns the tags.

Can this then be used to overcome the 32-tag limit?
For example, add 30 airtags to account1, add 30 tags to account2, decrypt the OwnedBeacons keys for all tags.

Then account3, or actually any account, could request the location reports of all 60 tags as long as the decrypted tag record is available?

Are there any rate limits emposed in API queries?

Can location records be queried for several tags at once, or is it one tag at a time, getting all reports for the past week for every query?

[malmeloo]

That's right, any account can query location reports, not just the owner. That does indeed mean that you are able to bypass the AirTag limit. You might also be able to use a single account by setting up a tag, dumping the plist and then removing it again, but this might prompt the owner device to reset the AirTag. I haven't tested this personally.

AFAIK there is no explicit rate limit, but there is a maximum amount of keys that can be requested at once. AirTags rotate their keys, so if the library detects that it needs to send multiple requests in order to retrieve all location reports, it will do so. The trick here is to request as few reports as necessary in order to prevent the anti-abuse system from kicking in; so if you're fetching locations for a lot of AirTags, either reduce the time range or your fetching frequency. You could also use multiple accounts to download reports if necessary, but you'll have to implement that logic yourself.

Currently the library only supports batching requests for multiple individual keys, but not yet for multiple accessories / AirTags. I will add it as a feature request!