Limits
What refuses a call on this account, in the order preflight checks it.
Per request
Checked first, with no database read. A call whose estimated_units exceed its ceiling is refused with ceiling_exceeded and reserves nothing.
Plan quota
50,000 preflight calls a month, counted and rolled inside the same transaction that reserves, so concurrent calls at the line cannot all pass. Past it the call is refused with plan_limit_exceeded and an upgrade_url.
Per customer
A customer is created the first time its id is seen, with 5,000 units, the account default. Change it with PUT /budget, which also creates the customer if it is new; a ceiling may be set below what is already used and reserved, and that customer is then refused until the reservations settle. Calls without a customer_id share the customer named default. The reservation is atomic: used, reserved and the estimate must fit under the limit together, or the call is refused with budget_exhausted.
Per task
Every call and tool that shares a task_ref is checked against one ceiling. The job is opened with it, on the first preflight that passes task_ceiling or on the task budgets view; after that the last save in the console is the ceiling in force, and a task_ceiling from code is not applied. A preflight for a job that does not exist yet, sent without a ceiling, is rejected with task_ceiling_required. Refused with task_ceiling_exceeded. A record that lands past the ceiling after the call ran is kept as a leak, not hidden.
The per-request ceiling is an argument to the call itself and has no endpoint. A customer's ceiling is set from the API: GET /budget?customer_id= returns the balance and creates the customer if it is new, PUT /budget sets it. A job's ceiling is the one number this console edits, on the task budgets view or with PUT /tasks/:task_ref/ceiling.
GET /decisions for refusals, /tasks for budgets and /tasks/:task_ref for a job's list-price estimate, /usage?by=event_type for the split by event_type and its estimate, /customers for balances, /keys for keys, each with Authorization: Bearer <your key>.