# Limits

## Rate limits

MapleID counts the per-IP limits for each IPv4 address or IPv6 /64 network. Hosted agents can share an address, so they also share its limit.

| What | Limit |
|---|---|
| The agent API, per IP | 600 requests in 1 minute |
| The MCP server, per IP | 600 requests in 1 minute |
| `/oauth/*`, per IP | 300 requests in 1 minute |
| The token endpoint, per client | 600 requests in 1 minute |
| The agent API and the MCP server, per agent client | 600 requests in 1 minute |
| The agent API and the MCP server, per agent client and person | 120 requests in 1 minute |
| Invitations, per person | 20 invitations in 1 hour |
| Invitations by agent clients, per organization | 50 invitations in 24 hours |
| Sign-in, per IP | 20 attempts in 15 minutes |
| Registration, per IP | 5 accounts in 1 hour |

A request over a limit gets 429 with `Retry-After`.

The agent API and the MCP server also send `RateLimit-Policy` and `RateLimit` on each answer, for their per-IP limit. These fields follow the IETF draft draft-ietf-httpapi-ratelimit-headers. They are experimental: their syntax can change with the draft. In `RateLimit`, `r` is the number of requests that the window still allows, and `t` is the number of seconds until the window starts again.

## Rate limits and shared IPs

Hosted agents often send their requests from shared addresses. All agents behind one address share each per-IP limit, so one busy agent can use the limit of the others. The limits per agent client and per person do not change with the address. If your agent gets 429 but sends few requests, its address is probably shared. Wait for the seconds in `Retry-After`, then send the requests more slowly.

## Tokens

- An access token lasts 15 minutes.
- A refresh token lasts until the session of its sign-in ends. A session lasts 14 days, and a refresh token 30 days at most. Then the agent signs in again.
- A person who signs out in another browser does not end the session of the agent.
- The refresh tokens end when the person signs out in the browser of the agent's sign-in.
- They also end when the person removes the agent in "Apps with access" on `/account`, resets the password or closes the account.
- They also end when an administrator resets the MFA of the person.

## Revocation delay

- A disabled agent client gets no new tokens, and its refresh tokens stop at once.
- MapleID's API and MCP server check the client on each call.
- Userinfo does not check the client. It answers until the access token expires, 15 minutes at most.
- An app that checks tokens without MapleID can see a revocation up to 15 minutes late.

## Audiences

A token has, in aud, every API resource of its scopes, plus `mapleid-userinfo` with `openid`. MapleID does not use the `resource` parameter. So a token with `mapleid.agent.mcp` and `mapleav.agent.scans.read` works on MapleID and on MapleAV. Never log a token or send it to another service.

## Agent clients

An organization has at most 10 active agent clients, and creates at most 20 in one day.