Skip to content
OpenAppPhysical access, fully managed
Login

Rate limit

Type
rate_limit
Category
Agent safety
Enforced at
Access-time
Tiers
OrgIntegration
Enforcement
Enforce
Default
Not configured — no policy throttle on opens.

Caps how many entity actions a principal may perform in a sliding window. Use this so a looping agent or script cannot hammer a door. Supply per_user or per_org as a positive integer; when both are set, per_user is used. per_user counts per agent, per API key, or per signed-in user. Exceeding the cap returns 429. Evaluated on the entity-action API; not on the portal open paths.

When it is enforced

Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.

Where to set it

Settings → Policies (org) or the integration Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.

NameTypeRequiredValuesDescription
per_userintegerNo—Maximum actions per principal in the window. At least one of per_user or per_org must be an integer greater than 0. Takes precedence over per_org when both are set.
per_orgintegerNo—Maximum actions per organization in the window, shared by every principal. Used only when per_user is absent.
window_secondsintegerYes—Sliding window length in seconds. Required; integer from 1 through 31536000 (365 days).
applies_tostring[]No
agentapi_keyinvitationmemberresidentadminall
Principal kinds this row binds, as a non-empty array of agent, api_key, invitation, member, resident, admin, all. Other kinds, a bare string, and empty arrays are rejected. `all` matches every kind this policy can bind. A caller is every kind it is at once, and a row binds when any of them is listed. When omitted, the default applies. Default: agent, api_key, invitation

How overlapping rows combine

For each principal kind the caller is, the row with the smallest cap (then the shortest window) applies. Distinct limits from different kinds are each counted once per request.

Example

An agent that retries an open more than 30 times in a minute is denied further opens until the window slides.

config
{
  "per_user": 30,
  "window_seconds": 60,
  "applies_to": [
    "agent",
    "api_key",
    "invitation"
  ]
}

Integrations

This type is documented on these connectors: