Rate limits

Two families of limit - what your plan allows, and how fast anyone may call an endpoint - with the numbers served by the API that enforces them.

cmssy enforces two different kinds of limit, and they answer different questions. A plan allowance says how much of the product your organization bought: pages, storage, delivery requests per month. A protection guard says how fast anyone may call one endpoint, on any plan. A request can sit comfortably inside your allowance and still be refused by a guard, and the guard is the one that answers 429.

What a 429 means

Every guard refuses the same way: HTTP 429 with a Retry-After header carrying the number of seconds until the window reopens. Wait that long, then retry.

The window is fixed, not a bucket that drains while you knock. A client that treats 429 as if it were 500 and retries straight away stays refused for the rest of the window, and burns its own capacity doing it. Read the header.

Delivery is budgeted per workspace

The delivery API is the one you call from your own server, so its budget is per workspace, not per caller. Every visitor to your site is rendered from a handful of your regional IPs, and a crawler warming a cold cache would spend a per-caller budget in seconds. The second delivery row is that wider abuse net, counted per caller - the token and the IP together, so two tokens behind one address get two buckets - not the budget your site runs against.

Every read counts, cached or not. A CDN in front of your site is how you stay inside the budget, because it cuts the reads that reach us at all - but a read that does reach us is counted whether or not you cache the answer.

Depth is not a rate

Two guards are measured in levels, not requests: a query nested deeper than the limit is rejected on the spot, and waiting changes nothing. Flatten the query.

Monthly allowances are pooled

Plan allowances belong to the organization, not to a single workspace. Delivery requests and bandwidth are pooled across every workspace the organization owns, and counted for the calendar month.

Reading the tables

Both tables below are served by the API that enforces the numbers, so this page cannot drift from the product. Rows marked as adjustable are the ones an operator can move for a deployment; every other number is the same for everyone.

What each plan allows

Pooled across every workspace the organization owns, and counted for the calendar month. Read from the same table billing enforces.

HobbyProEnterprise
Delivery requests / month100K2MUnlimited
Bandwidth / month50 GB200 GBUnlimited
Pages25UnlimitedUnlimited
Storage1 GB30 GBUnlimited
Largest upload50 MB500 MB2047 MB
Workspaces15Unlimited
Members15Unlimited

Protection limits

Read from the limiter that enforces them, family by family.

Delivery API

The public API your own server calls. Budgeted per workspace; the caller row is a wider abuse net. Every read counts, cached or not: a CDN in front of your site cuts the reads that reach us, it does not stretch the budget.

EndpointCounted perLimit
Delivery readsworkspace1,200 requests / minuteadjustable
Delivery readscaller (token + IP)600 requests / minuteadjustable
Delivery query depthquery10 levels deep / request

Cart, checkout and orders

EndpointCounted perLimit
Cart changesIP address30 writes / minute
CheckoutIP address10 writes / minute
Public ordersIP address20 writes / minute
Order changesIP address30 writes / minute

Form submissions

EndpointCounted perLimit
Form submissionsIP address5 submissions / minute
Form submit requestsIP address10 requests / minute

Media

EndpointCounted perLimit
Upload authorizationsaccount30 requests / minute
Media URL signingsaccount120 signed URLs / minute
Media URL signingsIP address300 signed URLs / minute

AI and the assistant

EndpointCounted perLimit
AI connection testsIP address10 requests / minute
AI model listingsIP address20 requests / minute
Spotlight chataccount20 requests / minute
Spotlight uploadsaccount30 requests / minute

Admin API

The authenticated API the admin app and your API tokens call.

EndpointCounted perLimit
Admin query depthquery20 levels deep / request

Signing in to the admin

EndpointCounted perLimit
Admin sign-inIP address10 attempts / 15 minutes
Admin sign-inaccount5 attempts / 15 minutes
Admin sign-upIP address5 attempts / 15 minutes
Admin sign-upaccount3 attempts / hour
Refresh requestsIP address300 requests / 15 minutes
Token refreshesIP address120 attempts / 15 minutes
OAuth sign-inIP address20 attempts / 15 minutes
SSO startIP address20 attempts / 15 minutes
SSO callbackIP address20 attempts / 15 minutes

Site members

The accounts your own site signs in, not cmssy accounts.

EndpointCounted perLimit
Member sign-upIP address5 attempts / 15 minutes
Member sign-upaccount3 attempts / hour
Member sign-inIP address10 attempts / 15 minutes
Member sign-inaccount5 attempts / 15 minutes
Password reset requestsIP address5 attempts / 15 minutes
Password reset requestsaccount3 attempts / hour
Password resetsIP address10 attempts / 15 minutes
Email verificationsIP address20 attempts / 15 minutes

Each number is the budget for one window; a call past it is refused with 429 and a Retry-After header.