# Limits and quotas

Limits and quotas in Siper: the periodic token budget, requests per minute (RPM), what a 429 response means, and how to retry correctly with Retry-After.

In normal use you will not hit a limit; the limits are deliberately generous. Two mechanisms apply to your account: a periodic token budget and a per-key requests-per-minute limit. The goal is not to restrict usage; it is to keep the service predictable for everyone.

## Token budget

All your requests are deducted from a single token budget defined for the period. Unused tokens do not expire at the end of the period; the budget rolls over and accumulates.

When the budget is used up, the service is not cut off. A warning appears in the panel when you reach 80% of the budget and another when the budget is used up; your requests keep being processed. Remaining tokens, usage rate, and the thresholds are shown live on the “Token Bütçesi” (Token Budget) card in the panel; see [Panel](/docs/en/panel/) for where the card is.

## Requests per minute (RPM)

A requests-per-minute (RPM) limit can optionally be defined for each virtual key. The default is unlimited; the limit applies only when explicitly set and protects the service during short bursts of load. The value applied to your key is shown in the key list in the panel; if there is no value, the key is unlimited.

## The 429 response and Retry-After

If you reach the RPM limit, the Gateway returns an OpenAI-compatible 429 response:

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 2
Content-Type: application/json

{
  "error": {
    "type": "rate_limit_exceeded",
    "message": "Dakika başına istek limiti aşıldı."
  }
}
```

The `Retry-After` header tells you how many seconds to wait before trying again. Most OpenAI SDKs retry a 429 on their own; if you are writing your own client, add retries with increasing intervals.

A 429 is not a quota overrun. When your token budget is used up, requests do not stop, and you only see a warning; a 429 is returned only for the momentary rate limit and resolves on its own once the `Retry-After` period passes.

## Masking pattern limits

Three limits apply to your organization’s own patterns: at most **25 patterns**, at most **200 characters** per pattern, and a time budget for scanning. The limits are not arbitrary: a single badly shaped pattern can keep masking busy for a long time, and the budget cuts that short.

When the budget is exceeded, the two directions behave differently, and the distinction is deliberate:

- A **masking pattern** that exceeds the budget causes the request to be rejected with `422`. We prefer returning an error over silently masking less than we should.
- An **exemption pattern** that exceeds the budget is simply not applied, and the request completes normally. An exemption reduces masking, and a rule that reduces masking should not take effect under uncertainty.

The same limits apply when you send patterns directly in the request body. The organization patterns you define in the panel are added to the ones in the request and cannot be dropped by the request body; the result can only increase masking. To define patterns from the panel, see [Panel](/docs/en/panel/).

## Input length

Each piece of text to be masked has a length limit: **20,000 characters**. A request that exceeds it never reaches the model; it comes back as `413`, and the message says what to do (split the text and retry).

The limit is **per text, not per request.** That distinction matters for batch work:

- The `input` field of a `/v1/embeddings` request may be an array. Three separate 15,000-character documents (45,000 in total) go through fine, because each one is below the limit on its own.
- One oversized document in the array, however, **fails the whole request**. For batch indexing, filter or split documents by length before sending; otherwise a single document forces the entire batch to be resent.

## Summary

| Limit | Default | Behavior when exceeded | Where it is shown |
| --- | --- | --- | --- |
| Token budget | Periodic, rolls over | Warning; service is not cut off | Token Budget card in the panel |
| RPM | Unlimited; configurable per key | `429` + `Retry-After` | Key list in the panel |
| Masking pattern | At most 25 patterns, 200 characters | Masking pattern `422`; exemption not applied | Settings > Masking Patterns |
| Input length | 20,000 characters per text | `413`; the request never reaches the model | Request response |

If you would like to increase your budget or define a custom limit for a key, get in touch with us.