DocsLimits
EndpointOS enforces several quotas to protect your API from accidental overuse and to make billing predictable. They stack: a request must pass every applicable limit.
Per-project monthly cap
Total successful requests across all keys, all consumers. Set in project settings. When exceeded, all subsequent requests for that month return 429 with a Retry-After header pointing at the start of the next month.
Per-consumer monthly cap
Same shape, scoped to a single consumer. Useful for partner agreements ("Acme can call up to 50k requests/month") or for tiered pricing in your own product.
Per-key per-minute rate limit
Each API key has a per-minute ceiling. Default is generous; tighten in the key's settings if you want stricter shaping. Exceeding returns 429 with a 60-second Retry-After.
Per-IP auth-path throttle
Login, signup, password-reset, and key-validation paths are rate-limited per source IP (60/min). This is platform-level; you don't configure it. It bounds credential-stuffing and key-bruteforce attempts.
Body guards
Public-API request bodies are capped at 1 MiB and 32 levels of JSON nesting. Prototype- pollution payloads (__proto__, constructor.prototype) are stripped at parse time. These limits are platform-level and not configurable.