Limits and quotas

Limits and quotas in Siper: the periodic token budget, requests per minute (RPM), what a 429 response means, and how to retry correctly with Retry-After.

In normal use you will not hit a limit; the limits are deliberately generous. Two mechanisms apply to your account: a periodic token budget and a per-key requests-per-minute limit. The goal is not to restrict usage; it is to keep the service predictable for everyone.

Token budget

All your requests are deducted from a single token budget defined for the period. Unused tokens do not expire at the end of the period; the budget rolls over and accumulates.

When the budget is used up, the service is not cut off. A warning appears in the panel when you reach 80% of the budget and another when the budget is used up; your requests keep being processed. Remaining tokens, usage rate, and the thresholds are shown live on the “Token Bütçesi” (Token Budget) card in the panel; see Panel for where the card is.

Requests per minute (RPM)

A requests-per-minute (RPM) limit can optionally be defined for each virtual key. The default is unlimited; the limit applies only when explicitly set and protects the service during short bursts of load. The value applied to your key is shown in the key list in the panel; if there is no value, the key is unlimited.

The 429 response and Retry-After

If you reach the RPM limit, the Gateway returns an OpenAI-compatible 429 response:

HTTP/1.1 429 Too Many Requests
Retry-After: 2
Content-Type: application/json

{
  "error": {
    "type": "rate_limit_exceeded",
    "message": "Dakika başına istek limiti aşıldı."
  }
}

The Retry-After header tells you how many seconds to wait before trying again. Most OpenAI SDKs retry a 429 on their own; if you are writing your own client, add retries with increasing intervals.

A 429 is not a quota overrun. When your token budget is used up, requests do not stop, and you only see a warning; a 429 is returned only for the momentary rate limit and resolves on its own once the Retry-After period passes.

Masking pattern limits

Three limits apply to your organization’s own patterns: at most 25 patterns, at most 200 characters per pattern, and a time budget for scanning. The limits are not arbitrary: a single badly shaped pattern can keep masking busy for a long time, and the budget cuts that short.

When the budget is exceeded, the two directions behave differently, and the distinction is deliberate:

• A masking pattern that exceeds the budget causes the request to be rejected with 422. We prefer returning an error over silently masking less than we should.
• An exemption pattern that exceeds the budget is simply not applied, and the request completes normally. An exemption reduces masking, and a rule that reduces masking should not take effect under uncertainty.

The same limits apply when you send patterns directly in the request body. The organization patterns you define in the panel are added to the ones in the request and cannot be dropped by the request body; the result can only increase masking. To define patterns from the panel, see Panel.

Summary

If you would like to increase your budget or define a custom limit for a key, get in touch with us.