Limits
What refuses a call on this account, in the order preflight checks it.
Per request
Checked first, with no database read. A call whose estimated_units exceed its ceiling is refused with ceiling_exceeded and reserves nothing.
Plan quota
50,000 preflight calls a month, counted and rolled inside the same transaction that reserves, so concurrent calls at the line cannot all pass. Past it the call is refused with plan_limit_exceeded and an upgrade_url.
Per customer
A customer is created the first time its id is seen, with 5,000 units, the account default. Change it with PUT /budget, which also creates the customer if it is new; a ceiling may be set below what is already used and reserved, and that customer is then refused until the reservations settle. Calls without a customer_id share the customer named default. The reservation is atomic: used, reserved and the estimate must fit under the limit together, or the call is refused with budget_exhausted.
Per task
Every call and tool that shares a task_ref is checked against one ceiling, fixed by the first preflight of that task; later task_ceiling values are ignored. A task preflight has never seen must carry a ceiling or the call is rejected with task_ceiling_required. Refused with task_ceiling_exceeded. A record that lands past the ceiling after the call ran is kept as a leak, not hidden.
Every ceiling above is set by the calling code, and read here. Nothing on this page edits one. GET /budget?customer_id= returns a customer's balance and creates it if it is new; PUT /budget sets that customer's ceiling. The per-request and per-task ceilings are arguments to the call itself and have no endpoint.
GET /decisions for refusals, /tasks for budgets, /customers for balances, /keys for keys, each with Authorization: Bearer <your key>.