Limits

Default entity limits and the errors Keycard returns at a limit or a rate limit.

Keycard limits how many of each entity you can create, and applies rate limits to some requests. Deleted and archived entities do not count toward an entity limit.

Entity limits

Entity	Default limit
Organizations created per person	5
Service accounts per organization	10
Zones per organization	25
Applications per Zone	500
Groups per Zone	1,000
Policies per Zone	500
Policy Sets per Zone	100
Providers per Zone	200
Resources per Zone	1,000
Roles per Zone	200
SCIM sync tokens per Zone	5
Vaulted credentials per Zone	1,000
Users per Zone	5,000
Credentials per Application	10
Dependencies per Application	1,000
Actions per Resource	1,000
Credentials per service account	10

When you reach a limit

When an entity is at its limit, Keycard rejects the next create request with HTTP 403 Forbidden. A retry does not succeed. Delete an entity that you do not use, or request a limit increase.

To detect this error, match details[].code to quota_exceeded. Keycard also returns the top-level code forbidden for missing permissions. details[].field names the entity, and details[].message describes the limit in words.

{
  "status": 403,
  "code": "forbidden",
  "message": "Limit of 5000 users per zone reached",
  "details": [
    {
      "field": "users",
      "code": "quota_exceeded",
      "message": "Limit of 5000 users per zone reached"
    }
  ],
  "request_id": "<request-id>"
}

A SCIM request at the User limit returns 403 with a SCIM error body instead. Its detail reads quota exceeded: limit of <limit> users per zone reached.

Rate limits

Keycard applies rate limits to some requests, per User, organization, Zone, or source IP address.

When a request exceeds a rate limit, Keycard returns HTTP 429 Too Many Requests with code set to rate_limit_exceeded. Retry with exponential backoff. If the response includes a Retry-After header, wait that many seconds before you retry.

Request a limit increase

To request a higher limit, email support@keycard.ai. Include your organization ID, the Zone ID for a per-Zone limit, the entity, and the limit you need.