---
title: "Set the project's per-IP rate-limit profile; applied to the running app (restart, no rebuild) when the platform has it switched on"
method: PUT
path: "/projects/{projectId}/rate-limit"
tags: ["Edge rules"]
---

# Set the project's per-IP rate-limit profile; applied to the running app (restart, no rebuild) when the platform has it switched on

`PUT /projects/{projectId}/rate-limit`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/projects/{projectId}/rate-limit`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `projectId` string, uuid, required

## Request body

- object
  - `mode` 'off' | 'default' | 'strict', required: off: no limit; default: the platform's generous per-IP limit; strict: a much lower one

## Response `200`

Updated

- object
  - `projectId` string, uuid, required
  - `mode` 'off' | 'default' | 'strict', required: off: no limit; default: the platform's generous per-IP limit; strict: a much lower one
  - `available` boolean, required
  - `supported` boolean, required
  - `profiles` object, nullable, required
    - `default` object, required
      - `average` integer, required: requests per second per client IP, sustained
      - `burst` integer, required: requests per client IP at once
      - `inFlight` integer, required: concurrent requests per client IP
    - `strict` object, required
      - `average` integer, required: requests per second per client IP, sustained
      - `burst` integer, required: requests per client IP at once
      - `inFlight` integer, required: concurrent requests per client IP
  - `engine` object, required
    - `status` 'applied' | 'pending_deploy' | 'not_configured' | 'error', required
    - `message` string, nullable, required
    - `appliedAt` string, nullable, required: ISO-8601 timestamp
  - `updatedAt` string, nullable, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request, e.g. an unknown mode (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)