Every limit a project enforces, in one place.
Most limits protect a project from an accidental flood and apply across plans. The per project numbers at the end vary by plan.
Rate limits
| What | Limit | Keyed by |
|---|---|---|
| Creating an anonymous session | 30 a minute | client address |
| Refreshing an anonymous session | 120 a minute | client address |
| Engagement event requests, each up to 50 events | 600 a minute | user |
A limited request answers 429 { "error": "rate_limited" } with a Retry-After header. Threads, messages, run reports, scores, traces, the project read API, and MCP are not rate limited.
Request sizes
| Object | Limit |
|---|---|
| Thread title | 1 to 255 characters |
Thread external_id | 1 to 255 characters |
Thread metadata | 16 keys. Keys are at most 64 characters and values are at most 512 characters. |
| Thread and message route IDs | 1 to 255 characters. A message list cursor is at most 256 characters. |
Message content | At most 1,048,576 serialized characters. |
| Messages deleted per request | 1 to 200 IDs |
Run thread_id, message_id, and trace_id | 1 to 255, 1 to 48, and 1 to 48 characters. A trace ID is a W3C trace ID only when it matches ^[0-9a-f]{32}$. |
Run root_span_id | Exactly 16 lowercase hexadecimal characters, matching ^[0-9a-f]{16}$. |
Run error and error_code | 2,048 and 64 characters. |
Run tags | 20 tags of 64 characters |
Run environment and release | 64 and 255 characters |
Run attributes, with metadata and unknown top level keys merged in | 16,384 serialized bytes. |
Run steps, tool_calls and sampling_calls | 1,000 entries each |
Run output_text, tool arguments, tool results, and step input | 50,000 characters each |
| Token counts | Whole numbers from 0 to 100,000,000 |
| Event batch | 1 to 50 events |
Event props | At most 1,024 UTF-16 code units in JSON.stringify(props) on the endpoint; cloud.events.track leaves props out when that JSON is over 1,024 bytes of UTF-8. Keys are 1 to 64 characters and string values are at most 256 characters. |
Event value | Whole number from 0 to 2,147,483,647 |
| Event IDs | thread_id, message_id, and run_id are each 1 to 48 characters. |
Score name and comment | 1 to 64 and 1 to 2,000 characters. The name uses letters, digits, ., _, and -. |
| Score targets | thread_id, message_id, and run_id are each 1 to 48 characters. |
Score string_value | 1 to 255 characters |
| Attachment upload | Filename is 1 to 255 characters. Declared content length is at most 25 MiB. |
| Trace export body | At most 4,194,304 bytes, or 4 MB, after gzip or deflate decompression. |
| Trace span count | At most 500 spans per trace. |
| Span attributes | 16,384 serialized bytes. Largest entries are dropped first when a trace is assembled. |
| Allowed origins | 32 entries of 255 characters |
| Renderer URL | At most 2,048 characters after URL normalization. |
Aui-Sdk header | The client accepts any printable name and version token. The server reads only the first 8 space separated tokens and records unique lowercase npm style names with strict SemVer versions, discarding duplicates. Each recorded name is at most 214 characters and each version is at most 64 characters. |
| API key user and workspace headers | Each is 1 to 255 characters and cannot contain whitespace or control characters. Aui-Workspace-Id is required for every API key request except trace export. Aui-User-Id defaults to __SYSTEM__; trace export without a workspace ID uses __OTLP__. |
| Auth rule fields | name and provider are 1 to 255 characters. jwks_url, audience, and issuer are 1 to 2,047 characters when present. workspace_id_field and name_field are at most 255 characters when present. |
| Harness | Name is 1 to 80 characters. An ID matches ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$. A harness has at most 16 backend entries. |
| Assistant execution | max_steps defaults to 10 and accepts 1 to 50. timeout_seconds defaults to 300 seconds and accepts 30 to 600 seconds. |
| Thread title input | At most 8,000 characters across the first user and assistant text. When the assistant has text, it receives up to 500 characters before the user allocation is calculated. |
A run report that exceeds validation caps is refused with 400. A trace body larger than 4 MB is refused with 413. The client trims telemetry tags before sending, but an oversized report received by the API is refused rather than trimmed.
List pages
| List | Default | Maximum |
|---|---|---|
GET /v1/threads | 20 | 100 |
GET /v1/threads/{thread_id}/messages | 200 | 200 |
GET /v1/projects/threads | 20 | 100 |
GET /v1/projects/threads/{thread_id}/messages | 200 | 200 |
GET /v1/projects/runs | 50 | 100 |
GET /v1/projects/scores | 50 | 200 |
GET /v1/projects/usage/daily | the last 30 days | 366 days |
| MCP run, thread, and score lists | 50 | 100 |
| Dashboard tables | 50 rows | 100 rows |
Time
| What | Value |
|---|---|
| Anonymous refresh token | 30 days, extended by 30 days on every refresh |
| Access token | 5 minutes |
| API key expiry | never, or 7, 30, 90 or 365 days |
| Presigned upload and download URLs | 15 minutes |
| Anonymous token request, client deadline | 30 seconds |
| Retention | 1 to 3,650 days, or forever. The dashboard presets are 7, 14, 30, 60, 90, 180, and 365 days. A shorter setting applies after 24 hours. |
| Alert cooldown | 5 minutes to 7 days |
| SDK client list | entries not seen for 180 days drop off |
| Thread title model call | 5 minutes, with at most 256 output tokens |
Per project
| What | Limit |
|---|---|
| Active users | Free includes and caps at 200. Pro includes 500 and caps at 5,000. Startup includes 10,000 and caps at 100,000. Enterprise is unlimited. |
| Alert rules | Free: 1. Pro and Startup: 20. Enterprise: 100. |
| Thread titles on the cloud model | Free includes and caps at 500 a month. Pro includes 5,000 and caps at 50,000 a month. Startup and Enterprise are unlimited. |
| Harnesses | Free: 0. Pro: 5. Startup: 25. Enterprise: unlimited. |
| Evaluators | 20 |
| Evaluator categories | 10 per rule |
| Thread title length | 2 to 12 words |
| Intelligence topic ceiling | 10 to 60 |
| Test user prefixes | 10 |