Limits
Four kinds of ceiling apply to API traffic. The first to be reached denies; they're enforced independently.
Per-key cost cap
A lifetime spend ceiling set on a key at mint time — the sum of the cost of every run it makes. Once reached, that key's runs return 402 plan_limit. It's a blast-radius limit on a single credential, smaller than the workspace-wide pools. See API keys → Cost cap.
Workspace inference spend
Runs draw down the workspace's included monthly inference, then its prepaid balance. When both are exhausted, runs return 402 plan_limit until you add credit or the monthly amount resets. This applies to all workspace activity, whichever credential made the run.
Request rate limits
Two windows in parallel, scoped to each API key:
| Plan | per minute | per hour |
|---|---|---|
| Free | 10 | 300 |
| Starter | 60 | 1,800 |
| Pro | 300 | 9,000 |
| Enterprise | 1,500 | 45,000 |
Both windows are checked on every authenticated request to /1.0/*. The first to be exceeded denies — 429 rate_limited with Retry-After and details.window = "minute" | "hour" indicating which window tripped.
Every response (including successful ones) carries RFC draft-7 RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset headers reflecting the tighter of the two remaining budgets, so you can pace from a single number. Limits apply per time window. Cost-cap (above) is the absolute safety net on spend; rate-limits are the floor that stops a runaway script before it gets there.
Run duration
timeoutMs defaults to 60,000 (1 minute) and caps at 600,000 (10 minutes) — pass a higher value on the run request when a flow legitimately needs longer. Hit the timeout and you get 504 timeout with whatever partial timeline accumulated.