Protocol and resource limits

The capabilities response is the runtime source for enabled limits. OpenAPI schemas provide enforceable maxima. Initial v1 design limits are:

• request body: 256 KiB;
• default page: 50 items; maximum page: 100;
• idempotency key: 16-128 printable ASCII characters, retained at least 24 hours;
• field lengths, collection sizes, and enums: the operation-specific OpenAPI request schema is authoritative;
• per-key rate limits: 600 reads, 180 writes, or 30 destructive operations per rolling minute; owner-wide limits are three times the corresponding key limit.

The runtime may advertise lower safety limits before general availability, but it must not silently exceed documented schema limits. Oversized bodies return 413; field and relationship limits return 422; throttling returns 429 with Retry-After.