Limits

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

Rate

Scope	Limit	Window
/v1 routes, per IP address	300 requests	1 sliding minute

The limit applies before any token check: a refused request (401, 403) counts too. Sessions and policies (/v1/iam/…), identity routes (tenants, templates) and tenant routes each have their own counter of 300 requests. Beyond that, the API responds 429, {"error": "rate limit exceeded"}, with a Retry-After header. The limit is per IP address as seen by the platform: behind a corporate NAT or in a shared CI, several clients share it.

Advice:

• Cache GET /v1/openapi.yaml (it carries an ETag and a Cache-Control).
• Do not poll in a loop: sng app describe every second from ten terminals exhausts the limit. Prefer sng app logs (stream) or an interval of 5 to 10 s.
• Respect Retry-After and apply an increasing delay on 429 and 503.

Timeouts

Timeout	Value
Reading of the request by the server	30 s
Writing of the response	60 s
Tenant session	1 h (5 min to 1 h for a session opened by a federated CI)
409 policies_pending response after a tenant is created	up to ~5 min, Retry-After: 10

Streams (GET /v1/apps/{name}/logs) are the only exception to the write timeout: the connection stays open as long as the client reads.

Size

• Request body: at most 1 MB, read with a strict decoder (unknown fields refused, no second JSON document following it).
• Manifests: each YAML document is validated against its kind's schema; the bounds (number of services, name length, number of DNS targets…) are in the manifest reference.
• Uploads (apply, cdn uploads): the API body does not carry the files. The API returns upload URLs and the client sends the bytes there directly.

Pagination

There is none: lists are returned in full. The volumes involved (manifests, secrets, applications of a tenant) stay in the order of a hundred. If a list grows large, filter on the client side (jq), and let us know.

Concurrency

• Two simultaneous applys on the same manifest: the last write wins. An apply is only taken into account after apply/complete, once all the manifests are uploaded.
• A secret rotation already in progress responds 409.
• A resource being deleted responds 409 to any modification.

CORS

The API does not return CORS headers: it is not designed to be called directly from a third party's browser. Go through a server (yours or a function) that holds the session.

Tenant quotas

Independently of the API limits, each tenant has a tier that bounds CPU, memory, number of instances, of monitors, etc. Exceeding it shows in the resources' status (QuotaExceeded) or as 409 tier too small. See Tiers.