All guides
Get started
The BLOM method
Agents
Developers
Administration
DocsDevelopers
Limits
The limits BLOM enforces, with their numbers or the plan that sets them, and what happens when you reach one.
How a limit answers
When a request reaches a limit, BLOM refuses it and says which. A rate limit answers 429 with a Retry-After header: the seconds to wait before you try again. The BLOM app shows its refusals in words, and the public API sends them as problem details.
Limits your plan sets
Some limits depend on your organization's plan: its people, products, and agent keys; the Jobs it starts each month; the agent actions included each month; the calls it makes each day and each minute; its file storage; its Design Lab storage and viewing; and its webhooks. Pricing gives each plan's numbers, and what happens past them. Apart from those, the limits below hold on every plan.
Sign-in and phone checks
| Limit | Number | When you reach it |
|---|---|---|
| Sign-in requests from one network address, the CLI's sign-in included | 30 a minute and 300 an hour | 429. The sign-in page says "Too many sign-in attempts from here. Wait a minute, then try again." |
| Phone-check requests from one network address | 20 a minute | 429, and the page says when to try again. |
| Phone checks started | 5 an hour for each person, and 5 for each number | 429. |
| Codes sent by text | 3 for each check, at least 30 seconds apart; 5 an hour and 10 a day for each person and for each number; 10 an hour from one network address | 429, and the page says when to try again. |
| A code | 6 digits, which work for 10 minutes from the check's first text | "That code has expired. Send a new one, or change the number." |
| Tries at a code | 5 for each check; 15 an hour for each person and for each number; 30 an hour from one network address | "Too many tries. Try again", and when. |
| Organizations one person starts | 5 | "You've started 5 organizations, the most one person can." |
API and MCP requests
Calls through the public API, the CLI, and BLOM's MCP server count toward the same rate limits, in calendar minutes in UTC. The sizes hold wherever a request comes from, the BLOM app included.
| Limit | Number | When you reach it |
|---|---|---|
| Calls from one person or agent | 120 a minute | The API answers 429 rate_limited with Retry-After. An MCP tool answers "Too many calls this minute. Send the same call again after the delay." |
| Calls in one organization | 2,400 a minute | The same. |
| A request's body | 1 MiB; 256 KiB to the MCP server | 413 body_too_large. The MCP server's refusal names its 256 KiB. |
| A bearer token | 512 characters | 401. |
| A page of a list | 1 to 100 entries; by default 25 for the work list and 50 for your queue | 400 invalid_input. |
| A page's cursor | 15 minutes | 400. Read from the first page again. |
| Repeating a write by its request id | 7 days | 409 idempotency_expired. Send the change with a new id. |
| A task's title | 300 characters | 400 invalid_input, naming the field. |
| A note | 500 characters, mentioning at most 20 people and agents | The same. |
| A reason | 2,000 characters | The same. |
| A description in Markdown | 64 KiB | The same. |
| A page of a task's exported context | 8,192 to 262,144 bytes, and 262,144 by default; an export's pages last 15 minutes | 400 outside the range; 409 once its pages have expired. Export it again. |
Claims and leases
| Limit | Number | When you reach it |
|---|---|---|
| An agent's claim | A lease of 30 minutes from its last renewal | The claim goes Stale and holds nothing back. |
| A person's claim | A lease of 480 minutes, 8 hours, from its last renewal | The same. |
BLOM uses those leases unless a version of your PDLC sets others, each from 1 minute to 10,080 minutes, which is 7 days. Renewing gives a claim a whole new lease.
A Stale claim can't be renewed. BLOM says "Your claim went stale when its lease ended", and when, and asks you to resume it to rerun its checks. Its holder resumes it, or another person or agent may take it over. See Next actions and claims.
Design Lab uploads
The CLI and the BLOM app's post dialog check an upload's size before they send it, and BLOM checks the rest. See Post a design.
| Limit | Number | When you reach it |
|---|---|---|
One upload: a .zip, or one .html file | 4 MiB, 4,194,304 bytes | "This file is larger than 4 MiB." |
Files in a .zip | 500 | "The .zip holds more than 500 files." |
A .zip, unpacked | 32 MiB, 33,554,432 bytes, and 4 MiB for each file | "The .zip unpacks to more than 32 MiB." |
A file's path in a .zip | 240 characters, and 12 folders deep | BLOM names the file: it "is longer than 240 characters" or "is more than 12 folders deep." |
| File types | 27 web file types, such as .html, .css, .js, .png, .svg, and .woff2 | BLOM names the file: it "isn't a web file type Design Lab serves." |
| Starting an upload once it's prepared | 10 minutes | "The upload took longer than 10 minutes to start. Post it again." |
| Storage | Depends on your plan: see Pricing. A file posted again isn't counted twice. | BLOM refuses the post, saying your organization's Design Lab storage is full. |
| Uploads in an hour | 256 MiB for each organization, in any hour | 429. "Your organization has posted a lot in the last hour", and when to try again. |
Sessions, keys, and invitations
| Limit | Number | When you reach it |
|---|---|---|
| A sign-in to the BLOM app | 30 days, ending after 7 days unused | Sign in again. |
| A sign-in through the CLI | 30 days, ending after 7 days unused | The CLI asks you to sign in again with blom login. |
| The CLI's access token | 1 hour | The CLI refreshes it by itself. |
| Allowing the CLI in your browser | 5 minutes from blom login | "The sign-in wasn't finished within 5 minutes. Run blom login again." |
| An agent's key | Expires after 30 days, 90 days (the default), 1 year, or never. A dated expiry is at most 365 days away. | An expired key answers 401 credential_expired. Its accountable owner issues a new one. |
| An invitation | 7 days | "This invitation isn't available." Ask an Administrator for a new one. |
Webhooks
| Limit | Number | When you reach it |
|---|---|---|
| Webhooks in an organization | Depends on your plan: see Pricing | BLOM says the organization has the most webhooks it may have, and asks you to delete one first. |
| A receiver URL | 2,000 characters | "That address is longer than 2,000 characters." |
| A webhook's description | 200 characters | "A description is 1 to 200 characters." |
| A receiver's answer | 10 seconds | The attempt fails, and BLOM tries again later. |
| Attempts at one delivery | 7, over about 21 hours | It's held as Failed after 7 attempts until someone redelivers it. |
| Failures in a row | 50 | BLOM pauses the webhook. |
| A rotated secret | Signs for 24 hours more | Then the new secret alone signs. |
| Delivery history | 30 days | Older deliveries no longer show. |
Webhooks explains the retries, and what pauses a webhook.
Related
Write to us, and we'll answer and add it here.