Limits and defaults
This page lists Gatelion's limits and default values. Where a value can be changed, the table says where and within which range.
Agents and calls
| What | Value | Can you change it? |
|---|---|---|
| Calls per minute, per agent | 60 | Yes, when you create the agent: 1 to 10,000 (Calls per minute) |
| Calls per minute, per agent, to each tool | 60 | No |
| How calls are counted | In one-minute windows that start with the first call | No |
| Calls per minute for your customers' agents | The same limits, counted for each agent and customer pair | No |
| Agent token lifetime | 90 days | Yes, when you issue the token: 1 to 365 days (Valid for (days)) |
| Size of one call's arguments | 64 KB | No |
| Nesting depth of one call's arguments | 32 levels | No |
| Size of one MCP request | 256 KB. Larger requests get HTTP 413. | Gateway setting |
| Calls running at once, per organization | 16 on a Gateway in your network, 8 on the hosted Gateway. More get busy. | Gateway setting |
| Time limit for a tool call | 5 seconds for reads, 10 seconds for writes | Yes, per operation in the API description: 1 to 60 seconds |
| Time limit for a connection | 10 seconds. The shorter of this and the tool's limit applies. | Yes, per connection (Timeout (ms)): 1 to 60 seconds |
| Size of a system's answer | 256 KB for reads, 64 KB for writes | Yes, per operation in the API description: 1 KB to 1 MB |
When a call goes over a rate limit, it's denied with rate_limited. See Error codes.
Approvals
| What | Value | Can you change it? |
|---|---|---|
| Time until a waiting request expires | 24 hours | Yes, per environment on Settings (Requests wait for approval for): 15 minutes to 7 days. Through the API: 5 to 10,080 minutes. Applies to new requests. |
| Validity of the grant to run an approved call | 60 seconds | No |
| How often the Gateway checks for decisions | Every 5 seconds | Gateway setting |
| Approver's comment | Up to 1,000 characters | No |
| Approval email retries | After 1, 4, 9 and 16 minutes; given up after 5 attempts | No |
Gateways and sync
| What | Value | Can you change it? |
|---|---|---|
| Sync with the Control Plane | Every 15 seconds | Gateway setting |
| Reporting what happened to calls | Every 5 seconds | Gateway setting |
| Reads keep working without contact for | 1 hour | Yes, per environment on Settings (Reads stop after): 5 minutes to 24 hours. Through the API: 60 to 86,400 seconds. |
| Writes without approval keep working without contact for | 15 minutes | Yes, per environment on Settings (Changes stop after): 1 minute to 1 hour, and no longer than reads. Through the API: 60 to 86,400 seconds. |
| Calls that need approval keep working without contact for | Never: they wait for contact | No |
| Snapshot lifetime | 7 days | No |
| Registration code for a Gateway in your network | Valid for 15 minutes, works once | No |
| Default port of a Gateway in your network | 5200 | Yes, when you install it |
Gateways apply new windows at their next sync. A value outside the allowed range is refused, and nothing changes. See Gateways and sync and Settings.
Imports
| What | Value |
|---|---|
| Formats | OpenAPI 3.0 and 3.1, as JSON or YAML. Swagger 2.0 is refused. |
| Size of an API description | 2 MB |
| Operations in one API description | 500 |
| Nesting depth of an API description | 64 levels |
| Argument fields per tool | 300. An operation with more isn't supported. |
| Tool id | Up to 100 characters: the system key, a dot, and the operation's id |
| System key | 2 to 31 characters: lowercase letters, digits or _, starting with a letter |
| Described operations | 500, each with up to 100 query parameters, 100 headers and 100 body fields |
| Described operation's id | 1 to 64 characters: lowercase letters, digits or _, starting with a letter |
| Postman collection | v2.0 or v2.1, up to 2 MB and folders 16 levels deep. The first 500 requests are read. |
| curl command | One command, up to 100 KB |
See Connect a system and OpenAPI extensions.
Accounts and sign-in
| What | Value |
|---|---|
| Password length | 12 to 128 characters |
| Failed sign-ins before the account is locked | 5, then locked for 15 minutes |
| Console session | Ends after 12 hours without use |
| Sign-up confirmation link and code | Valid for 24 hours |
| New confirmation links | Up to 3 an hour |
| Unconfirmed sign-up | Released after 7 days |
| Sign-ups | 5 an hour from one network address, 200 a day across Gatelion |
| Invitation | Valid for 72 hours |
| Password reset link | Valid for 30 minutes |
| Second-factor step after the password | 5 minutes |
| Confirming it's you before a security change | Valid for 5 minutes |
| Authenticator app codes | 6 digits, a new one every 30 seconds |
| Recovery codes | 10, each works once |
| Sign-in requests | 30 a minute from one network address |
See Sign-in security.
Usage limits
Each organization usually has these limits. Gatelion may adjust them, and can raise them for your organization: contact Gatelion. The Usage page shows the limits that apply to you, and what you use against each.
| What | Limit |
|---|---|
| Environments | 3 |
| Gateways | 5. Retired Gateways don't count. |
| Of those, hosted by Gatelion | 1. Retired ones don't count. |
| Connected systems | 10 |
| Tools | 200, switched on or off |
| Agents | 20. Your customers' agents don't count. |
| People | 25, including people invited who haven't accepted yet. People whose access was removed don't count. |
| Approval requests | 500 a day |
| Tool calls | 5,000 a day, denied calls included |
Days run from midnight to midnight in your organization's time zone, and limits count across all your environments.
- Adding something over a limit is refused with HTTP 429 and
quota_exceeded. - An approval request over the daily limit is refused, and the agent's call ends
rejectedwithquota_exceeded. - Once your organization reaches its daily tool calls, your Gateways deny further calls with
quota_exceededfrom their next sync until midnight in your organization's time zone. Calls are counted as Gateways report them, so a few more may get through first.
See Usage and limits.
Outside agents
| What | Value |
|---|---|
| Agent registrations | 20 an hour from one network address; 50 an hour and 200 in total per Gateway |
| Redirect addresses per registered agent | 1 to 5 |
| Customer's sign-in and consent | Must be finished within 10 minutes |
| Authorization code | Valid for 60 seconds, works once |
| Access token | Valid for 60 minutes |
| Refresh token | Valid for 30 days, replaced each time it's used |
| Token requests | 120 a minute from one network address |
| Sign-in, consent and confirmation pages | 60 a minute from one network address |
| Customer's confirmation of a call | A new sign-in at your login, no older than 5 minutes, finished within 10 minutes |
| Identity header | Valid for 60 seconds |
| Identity keys (JWKS) | 120 requests a minute from one network address; may be cached for 5 minutes |
See Your customers' agents and Verify the identity header.
Still stuck? Contact support from the console.