Beta limits
Published before you hit them, so you can design against them rather than discover them. Every number below is a share of something that was measured, and each says which measurement.
Where the numbers come from
This deployment was measured against sources answering in 445 ms. Its admission pool holds 64 requests in flight, and the figure that qualification called safe was 22 concurrent and about 12 requests a second — roughly 43,500 requests an hour for the whole deployment.
Every per-project limit is a stated fraction of that. Nothing here is a round number somebody liked.
What a limit refusal looks like
It names the limit, what it is, what you have used, and when it comes back:
{
"error": "LIMIT_EXCEEDED",
"limit": "REQUESTS_PER_HOUR_PER_PROJECT",
"scope": "PROJECT",
"subject": "prj_000024",
"allowed": 5000,
"used": 5000,
"unit": "WINDOW",
"resets_at": 1789180000,
"remedy": "Wait for the window to turn over, or slow down."
}409 and 429 mean different things
A limit on how many of something you may hold answers
409 and carries no Retry-After: waiting will not
help, and telling you to retry a request that cannot succeed until you delete a
project would be worse than telling you it cannot.
A limit on how much you may spend in a window answers 429 with a real reset. So does a rate limit, for a second.
A limit refusal is not a weaker answer
Nothing in a limit refusal carries a trust class, a coverage statement or an evidence basis. Being rate limited means slow down; it never means the answer would have been weaker.
The limits
Per account
| Limit | Free Beta | Why that number |
|---|---|---|
| Organizations | 2 | One tenant to work in and one to try something in. |
Per organization
| Limit | Free Beta | Why that number |
|---|---|---|
| Projects | 3 | A project’s full in-memory ceiling was measured at 10.62 MiB. Three per organization keeps a Beta-sized population inside a single gigabyte. |
| Members | 5 | Sized for a team evaluating the API. |
Per project
| Limit | Free Beta | Why that number |
|---|---|---|
| Requests an hour | 5,000 | About an eighth of the deployment’s measured safe hour, so no one project can spend it. |
| Requests a second | 5 | The whole deployment’s measured safe sustained rate is 12.1 a second. Five lets two projects run flat out. |
| Burst | 10 | Twice the sustained rate. The measurement found the failure above the pool ceiling is a cliff rather than a slope, so the burst is small on purpose. |
| Requests in flight | 4 | The pool holds 64 slots and 22 were called safe. Four per project means five saturated projects reach that figure, rather than one taking a quarter. |
| Response bytes an hour | 256 MiB | 5,000 requests would have to average 52 KiB each to reach it. |
| API keys | 5 | Rotation needs two live at once; five leaves room and keeps a leak easy to find. |
| Networks | 6 | Six networks carry a commercially available capability here. A seventh is not a limit, it is an absence. |
| Products | 2 | Two products have any availability on this deployment. |
| WebSocket connections | 4 | A held connection is a held slot, matched to the in-flight limit so neither can be used to get round the other. |
| Payment watches held | 200 | Well inside one acquisition pass’s budget. |
| Payment watches active | 50 | An active watch costs upstream calls on every pass across every followed network. |
| Webhook endpoints | 3 | Enough to route by environment. |
Narrower than a project
Three limits bind below the project, so one part of a workload cannot spend all of it:
| Limit | Free Beta | Why |
|---|---|---|
| Requests an hour, per product | 4,000 | A project using both products cannot put its whole allowance through one. |
| Requests an hour, per capability | 3,000 | One method cannot starve the others of the project’s allowance. |
| Requests an hour, per network | 2,000 | The same bulkhead the admission controller uses one level up: a single stuck source once held 25 slots long enough to refuse 1.2 million requests. |
The number on your dashboard and the number that refuses you are the same object. There is no second path that produces a limit for display.
What is not a Beta limit
Per-IP rate limiting exists and is abuse control, not entitlement. It protects sign-up and sign-in from automation and is deliberately separate from everything above: a shared office or a NAT should not consume a customer’s allowance, and a customer’s allowance should not be spent by somebody else on their address.
If a limit is in your way
An operator can raise one for your organization, with a reason and an expiry. Open a support request saying which limit and what you are trying to do. A raised limit is shown on your dashboard as raised, so you do not design against a number that is about to expire.