---
title: "Set (fully replace) the organization's limit override; a null field means \"use the plan's own value\""
method: PUT
path: "/operator/organizations/{organizationId}/limits"
tags: ["Operator"]
---

# Set (fully replace) the organization's limit override; a null field means "use the plan's own value"

`PUT /operator/organizations/{organizationId}/limits`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/operator/organizations/{organizationId}/limits`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `organizationId` string, uuid, required

## Request body

- object
  - `projects` integer, nullable, required
  - `databases` integer, nullable, required
  - `seats` integer, nullable, required
  - `cpus` number, nullable, required
  - `memoryMb` integer, nullable, required
  - `buildMinutes` integer, nullable, required
  - `aiCredits` integer, nullable, required
  - `totalCpus` number, nullable
  - `totalMemoryMb` integer, nullable
  - `storageGb` integer, nullable
  - `bandwidthGb` integer, nullable
  - `deployedSitesMax` integer, nullable
  - `trialDays` integer, nullable
  - `requestsPerMonth` integer, nullable
  - `cpuHoursPerMonth` number, nullable
  - `previewsPerTeam` integer, nullable
  - `previewsPerProject` integer, nullable
  - `agents` integer, nullable
  - `builderSessions` integer, nullable
  - `importsOpen` integer, nullable
  - `buildConcurrency` integer, nullable
  - `buildTimeoutMinutes` integer, nullable
  - `pidsPerContainer` integer, nullable
  - `cpuShares` integer, nullable
  - `oomScoreAdj` integer, nullable
  - `diskGbPerProject` number, nullable
  - `uploadMb` integer, nullable
  - `crashLoopRestartsPerHour` integer, nullable
  - `allowedClasses` string[], nullable: site classes the plan may create, deploy, start, preview and publish; null = the next layer decides
  - `rateLimitProfile` 'off' | 'default' | 'strict' | 'null', nullable
  - `note` string, nullable, required
  - `reason` string, required: required: shown in the audit log verbatim
  - `requestId` string: idempotency key: a retried request with the same id changes nothing and writes no second audit entry

## Response `200`

Saved

- object
  - `status` 'ok', required
  - `replay` boolean
  - `override` object, required
    - `projects` integer, nullable, required
    - `databases` integer, nullable, required
    - `seats` integer, nullable, required
    - `cpus` number, nullable, required
    - `memoryMb` integer, nullable, required
    - `buildMinutes` integer, nullable, required
    - `aiCredits` integer, nullable, required
    - `totalCpus` number, nullable, required: org-wide cap on the sum of vCPU over every project and database (migration 136); null = none
    - `totalMemoryMb` integer, nullable, required: org-wide cap on the sum of memory (MB) over every project and database; null = none
    - `storageGb` integer, nullable: persistent volume storage of the whole team, GB (migration 203)
    - `bandwidthGb` integer, nullable: bandwidth per month, GB (migration 203)
    - `deployedSitesMax` number, nullable
    - `trialDays` number, nullable
    - `requestsPerMonth` number, nullable
    - `cpuHoursPerMonth` number, nullable
    - `previewsPerTeam` number, nullable
    - `previewsPerProject` number, nullable
    - `agents` number, nullable
    - `builderSessions` number, nullable
    - `importsOpen` number, nullable
    - `buildConcurrency` number, nullable
    - `buildTimeoutMinutes` number, nullable
    - `pidsPerContainer` number, nullable
    - `cpuShares` number, nullable
    - `oomScoreAdj` number, nullable
    - `diskGbPerProject` number, nullable
    - `uploadMb` number, nullable
    - `crashLoopRestartsPerHour` number, nullable
    - `allowedClasses` string[], nullable
    - `rateLimitProfile` 'off' | 'default' | 'strict' | 'null', nullable
    - `note` string, nullable, required
    - `updatedBy` string, uuid, nullable, required
    - `updatedByEmail` string, nullable, required
    - `updatedAt` string, nullable, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request (code invalid_request)
- `403`: An action on an operator-console session older than 5 minutes (code forbidden, details.reauthenticate: sign in again at /admin/login), or an operator removed since the session was resolved
- `404`: Not found (code not_found); also the answer to any request without a live operator-console session (no admin cookie, a dashboard session, an API/MCP key or OAuth token, or a caller who is not a platform operator)
- `409`: A team of the platform owner: overrides do not apply (code conflict, details.reason unlimited_org)
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Not available on this server (code not_configured)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)