--- title: "Get Philter's limits and the caller's capabilities." method: GET path: "/api/limits" tags: ["Limits"] --- # Get Philter's limits and the caller's capabilities. `GET /api/limits` ## Request - Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin) - URL: `/api/limits` - Auth: HTTP bearer Returns the sizes, lengths, and name rules Philter enforces, the session key timeouts, and what the caller may do: their role, how many contexts they have, and whether they may reach other users' resources or delete ledger chains. Each value is the one Philter enforces, including any set through its environment variable. Any key may call it, whatever its scopes, including a session key that must first change its password or enroll in MFA, since it describes the API and the caller's own access. For an administrator, crossUserAccess and ledgerDeletion reflect ADMIN_CROSS_USER_ACCESS_ENABLED and LEDGER_DELETION_ENABLED; for anyone else they are false, so the response does not reveal those settings. ## Headers - `Authorization` string, required ## Response `200` The limits and the caller's capabilities. - LimitsResponse - `auditExport` AuditExportLimits - `defaultPageSize` integer: The rows a page of the export has when limit is not given. - `maxPageSize` integer: The most rows a page of the export can have. - `maxWindowDays` integer: The most days between an export's from and to dates. - `caller` CallerCapabilities - `contextCount` integer: How many contexts the caller has, to compare with contexts.maxPerUser. - `crossUserAccess` boolean: Whether the caller may reach other users' resources with owner and all_users: an administrator, with ADMIN_CROSS_USER_ACCESS_ENABLED on. Always false for a user who is not an administrator. - `ledgerDeletion` boolean: Whether the caller may delete and purge ledger chains: an administrator, with LEDGER_DELETION_ENABLED on. Always false for a user who is not an administrator. - `role` string: The caller's role, read when the request is made. - `contexts` ContextRules - `maxEntries` integer: The most entries a context holds. Adding one more evicts the least-read entry. Set by MAX_CONTEXT_SIZE. - `maxPerUser` integer: The most contexts a user can have. - `customLists` CustomListRules - `descriptionMaxLength` integer: The most characters a custom list description can have. - `itemMaxLength` integer: The most characters an item can have. - `maxItems` integer: The most items a custom list can have. - `legalHolds` LegalHoldRules - `scopeTypes` string[]: The scope types a legal hold can have. - `names` PathSafeNameRules - `controlCharactersForbidden` boolean: Whether control characters are refused too. - `forbiddenCharacters` string[]: The characters such a name cannot contain. - `reservedNames` string[]: Whole names that are refused. - `rule` string: The rule in words, as Philter's error messages state it. - `password` PasswordRules - `maxBytes` integer: The most bytes a password can have in UTF-8. - `minCharacters` integer: The fewest characters a password can have. - `policies` PolicyRules - `defaultPolicyName` string: The policy every user is given, which cannot be deleted. - `descriptionMaxLength` integer: The most characters a policy description can have. - `nameMaxLength` integer: The most characters a policy name can have. - `namePattern` string: The regular expression a policy name must match. - `notesMaxLength` integer: The most characters a policy's notes can have. - `reservedNamePrefix` string: The prefix of managed policies' names, which a user's policy cannot start with. - `reservedNames` string[]: Whole names a policy cannot have, because the API's paths use them for something else. - `redactLists` RedactListRules - `maxTerms` integer: The most terms each of the always-redact and never-redact lists can have. - `termMaxLength` integer: The most characters a term can have. - `requests` RequestLimits - `defaultPageSize` integer: The page size a listing uses when limit is not given. - `maxBodyBytes` integer: The largest body any other request accepts, in bytes. Set by MAX_FILE_SIZE_BYTES_OTHER. - `maxDocumentBytes` integer: The largest body POST /api/filter and POST /api/explain accept, in bytes. Set by MAX_FILE_SIZE_BYTES. - `maxPageSize` integer: The largest limit a listing honors. A larger limit is reduced to this. - `sessionKeys` SessionKeyLimits - `idleTimeoutMinutes` integer: Minutes without a request after which a session key expires. Set by SESSION_KEY_IDLE_TIMEOUT_MINUTES. - `maxLifetimeMinutes` integer: Minutes after issue at which a session key expires, whatever its use. Set by SESSION_KEY_MAX_LIFETIME_MINUTES. - `users` UserRules - `reservedUsernames` string[]: Usernames that cannot be used, compared without regard to case. - `roles` string[]: The roles a user can have. - `webhook` WebhookRules - `secretMinLength` integer: The fewest characters a webhook secret can have. ## Other responses - `400`: Bad Request - `401`: The Authorization header is absent or the API key is not recognized. - `404`: Not Found - `406`: No representation matches Accept. - `413`: Content Too Large - `415`: Unsupported Media Type - `500`: Internal Server Error - `503`: Service Unavailable ## Changes - **2026-10-17** `25d87e0bb8f0`: 1 info - added the optional property `customLists/descriptionMaxLength` to the response with the `200` status - **2026-10-10** `c4f85daa9208`: 13 info - added the non-success response with the status `404` - added the optional property `field` to the response with the `400` status - added the optional property `field` to the response with the `401` status - added the optional property `field` to the response with the `413` status - …9 more - **2026-10-10** `83c006f9cb7b`: 1 info - added the optional property `policies/reservedNames` to the response with the `200` status - **2026-10-10** `da689fe402a5`: 1 info - endpoint added [Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/limits/get.md) --- [API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)