Limits and rate limits

Rate limits

Nexio counts requests to /api/v1/ in a one-minute sliding window per org. Each request counts against exactly one bucket.

Bucket	Applies to	Requests per minute
Default	Every `/api/v1/` route not listed below	60 per org (the platform default)
Data reads	Every Records route (`/records/...`, `/actions`, `/operations/{id}`), and every `GET /api/v1/catalog/...`	30,000 per org
Conversation turns	`POST /api/v1/conversation-instances/{slug}/conversations/{conversation_id}/turns`	300 per org
Per engine	Any route with an engine slug in the path, when the engine’s configuration sets `quotas.requests_per_minute` above 0	The configured value, counted per engine

Buckets are per org, not per API key or environment. Sandbox and live traffic share them.
When an engine sets its own limit, requests to that engine count against the engine’s bucket instead of the org default. A change to an engine’s limit takes effect within 30 seconds.
The data reads and conversation turns buckets never go below the numbers above. If the platform default is set above them, the higher default applies.
Authentication runs first, so a bad key gets 401, never 429.

Over the limit, the API answers 429 with a Retry-After header in whole seconds, at least 1:

{
  "code": "rate_limited",
  "message": "Rate limit exceeded"
}

Wait for Retry-After before sending again.

Inbound events

POST /api/v1/events/ingest/{source_key} has its own limits, because it is not called with an API key:

Limit	Value
Per client IP address	120 requests per minute
Per ingest source	600 requests per minute
Body	1 MiB

See Inbound events.

Body size

Route	Maximum body
Every `POST`, `PUT` and `PATCH` unless listed	1 MiB
Run submission for most engine types	1 MiB
Run submission for `triage` engines	16 MiB
Run submission for the Nexio-operated `commercial-risk-profile` and `commercial-program` engines	3,753,664 bytes (about 3.6 MiB): a 2,705,088-byte input budget plus 1 MiB
Engine create (`POST /api/v1/engines`), engine update (`PATCH /api/v1/engines/{engine_slug}`), config replace (`PUT /api/v1/engines/{engine_slug}/config`) and config validate (`POST /api/v1/engines/{engine_slug}/config/validate`)	256 KiB
Run cancellation (`POST /api/v1/runs/{run_id}/cancel`)	16 KiB
Environment create and update	4 KiB
Webhook endpoint create and update	64 KiB
Conversation attachment upload	The per-file attachment limit plus 1 MiB. See Attachments

A run submission over its body limit gets 413 request_bound_exceeded with "bound": "http_envelope_bytes".

Request bounds

Before a run is created, Nexio measures the submission’s input and offerings as compact JSON and checks five bounds. The first violation found is returned, and no run is created, no run cap is used, and nothing is queued.

Bound	Default	Triage engines	Most an engine can be configured to	Status when exceeded
`max_canonical_bytes`: total JSON bytes of `input` plus `offerings`	262,144 (256 KiB)	16,777,216 (16 MiB)	1,048,576 (1 MiB)	`413`
`max_string_length`: characters in one string	16,384	16,384	65,536	`400`
`max_array_items`: items in one array	100	10,000	1,000	`400`
`max_object_fields`: fields in one object	100	100	1,000	`400`
`max_object_depth`: nesting depth	12	12	32	`400`

Default applies to comparison, matching, entity analysis, diligence and opportunity engines.
Triage engines rank a whole population in one submission, so they use larger bounds for total bytes and array items.
Engine configuration. A released comparison, entity analysis or diligence engine configuration can set request_bounds to replace any bound, field by field, with a value up to the last column. A value of 0 or an omitted field keeps the default from the table.
The two Nexio-operated engines named under Body size have their own request bounds, set by Nexio.

The refusal names the bound, the JSON path, the limit and the measured value:

{
  "code": "request_bound_exceeded",
  "message": "The submission exceeds max_array_items: measured 101, limit 100. No run was submitted; reduce the submission or ask an operator to review this bound.",
  "details": {
    "bound": "max_array_items",
    "measured": 101,
    "actual": 101,
    "limit": 100,
    "path": "$.input.items"
  }
}

details has five fields. measured and actual carry the same number; actual is kept for older clients. bound is one of http_envelope_bytes, max_canonical_bytes, max_string_length, max_array_items, max_object_fields or max_object_depth. Some engine configurations can also declare resource_limits with max_provider_calls (0, or 1 to 100) and max_output_tokens (0, or 1 to 1,000,000). Nexio validates them when you save. They are built, not yet enforced at run time, whatever the value.

Time limits

Limit	Value
Request time budget	30 seconds, then `504 request_timeout`
Exempt from the 30-second budget	`POST /api/v1/converse`, conversation turns and conversation instance publish
`GET /records/accounts/{id}/rollups/program-evidence`	180 seconds
Other `GET` reads under `/records`, and `GET /api/v1/engines/{engine_slug}/opportunities` and below	120 seconds
Caller deadline	A `Nexio-Timeout: <milliseconds>` request header shortens any of these budgets, never lengthens it. See Requests and errors

A run does its work after the 202, so the time budget covers only the submission. Poll or use webhooks for the result.

Monthly run cap

Your org can have a monthly cap on the number of runs it creates.

The month is a UTC calendar month.
Every created run counts one: live, sandbox and fixture runs alike.
The check and the count happen in the same step that creates the run, so concurrent submissions cannot pass the cap.
A refused submission, or an idempotent replay of an earlier run, does not count.
An org with no cap set is uncapped.

At the cap, no run is created and the API answers 429:

{
  "code": "run_cap_exceeded",
  "message": "Monthly run cap reached for this organization. Contact support to raise the limit."
}

Do not retry this code. Nexio sets and changes the cap for you; there is no portal control for it.

Other limits

Limit	Value
Sandbox environments per org	5
Environment slug	1 to 16 characters, `^[a-z0-9_]{1,16}$`
Environment name	64 bytes of UTF-8 text
`Idempotency-Key` on run submission	255 characters (Unicode characters, not bytes, after trimming whitespace)
Outcome reason text	1,000 characters (Unicode characters, not bytes)
Subjects in one latest-run batch	1 to 100

Request a change

Email support@usenexio.com with your environment slug, the engine slug, the peak requests per minute you expect, the monthly run count you expect, and a recent x-request-id or run_id.

Start here

Engines

Conversations

Connections and data

Records

Events and webhooks

Platform

Reference

Limits and rate limits

Rate limits

Inbound events

Body size

Request bounds

Time limits

Monthly run cap

Other limits

Request a change

​Rate limits

​Inbound events

​Body size

​Request bounds

​Time limits

​Monthly run cap

​Other limits

​Request a change

Rate limits

Inbound events

Body size

Request bounds

Time limits

Monthly run cap

Other limits

Request a change