Quotas and keys

Client daily limits apply to POST /v1/jobs and POST /v1/stream (UTC day). Hosted chat uses the same stream path and counts against the same client row.

Limits

  • Client daily limit — all traffic for the API key / tenant.
  • Per-user daily requests — external_user_id meter when configured.
  • Per-user priority — when options.priority is priority and a priority cap is set.
  • Per-user Deep Dive — when Deep Dive is requested and a Deep Dive cap is set.
  • Feedback routes do not consume quota.
  • Deep Dive also has its own policy flag on the client row (off by default for new partners).

GET /v1/usage (and hosted /chat/usage) returns those three dimensions as used / limit / remaining for the current UTC day. See API reference for the payload shape. The conversation “context usage” meter in the hosted UI is a token-window hint, not this API quota.

Monthly responses

Separate from the daily limits above, and starting 2026-10-01 (UTC), each workspace has a monthly pool of Aimee responses. One response is one answered question, including follow-up questions inside the same conversation; a conversation is many responses. The pool is shared by everyone on the workspace, resets at the start of each UTC month, and does not roll over.

  • Included — each workspace gets a flat number of free responses each month (20 by default), no matter how many seats it has.
  • Response package — an optional recurring package adds its responses to the pool every month. Sales assigns it; there is no self-serve checkout in this product slice.
  • Running out — the stream returns HTTP 402 with error_code monthly_quota_exceeded, plus the current balance and package pricing. Chat resumes at the start of the next UTC month, or as soon as a package is added.
  • No subscription — past_due and canceled workspaces get HTTP 403 with aimee_plan_required.

Admins see the balance and the active package on the account page. GET /chat/usage returns the same balance as quota alongside the daily dimensions.

Rotate

Rotating the secret key invalidates the previous plaintext immediately. Update your backend config. The hosted page does not use that key, so SKU 2 chat keeps working until you rotate the handoff kid (which invalidates outstanding hosted session tokens).

POST /v1/hosted-session does not consume the client daily quota.

Disable

Revoking the client sets enabled = 0. API Bearer calls fail. The tenant hostname 404s until the row is enabled again. Disabling one hosted user (from /account) blocks only that person.