Limits & Quotas

Resource Limits

Product Subscriptions

Subscription limits count across all projects you own, not per-project. If you’re on the Starter plan (20 subscriptions) and own 3 projects, the 20 subscriptions are shared across all three.

Team Members

Team member limits are per-project. Each project can have up to the limit defined by the owner’s tier.

API Tokens

There is no cap on the number of API tokens a project can hold, on any tier. Create a separate token per integration so you can revoke one without disturbing the others.

API Rate Limits

The API rate limit is determined by the project owner’s subscription tier. All requests to the same project share one rate limit bucket, regardless of which token or member makes the request.

CVEQL queries are metered separately from the rest of the API — see the API rate limits reference for the per-tier figures and the per-IP limits that apply to unauthenticated calls.

What Happens When You Hit a Limit

• Subscription limit: You’ll see an error when trying to add a new subscription. Existing subscriptions continue to work.
• Rate limit: API requests return 429 Too Many Requests with a Retry-After header.
• Tier-gated endpoint: an endpoint that requires a higher tier returns 403 Forbidden with a message naming the tier required. On project-scoped endpoints the tier checked is the project owner’s, not the caller’s.

Checking Usage

There is no billing page that reports usage. The counters live next to the resources they meter:

• Tech Stack Management — a Subscription Counter card reading “You used X of Y of your product subscription”, where X is the pooled total across every project you own.
• Project Dashboard — products monitored and members for that project, each shown against the owner’s tier limit. The products figure counts only this project, so on a multi-project account it can read lower than the pooled total the subscription limit applies to.
• My Projects — projects used out of your project limit.
• Members — member slots used on that project.

Over the API, GET /api/projects/{project_id}/ returns the owner’s subscription usage alongside their tier and its features:

{
  "product_subscriptions": {
    "current_usage": 12,
    "max_limit": 20,
    "remaining": 8
  }
}

current_usage is the owner’s pooled total across every project they own, matching the counting rule above — not the count for the project you queried.