Get an account's limits and enforcement state

GET

/api/v1/accounts/{accountId}/limits

Returns every plan limit of the account with its resolved threshold (the account's own number, or the platform default it follows), enforcement state, stored value, and whether the number is an operator-agreed limit; plus the vetting label and billing tier. enforcement is enforced, log_only (shadow mode: measured without refusing), or off (limit null). Shadow mode preserves the numeric threshold. This describes configured behavior, not transient ledger health or other refusal checks. The mailbox ceiling and the mailbox, address and domain creation limits bound the account's own key; an operator's system key is not held to them. Current usage is on send-usage, receive-usage and storage-usage.

Authorization

bearerAuth

headerAuthorizationBearer <token>

Two credential kinds share this scheme; GET /api/v1/auth/whoami answers which one you hold and what it reaches.

oek_… API key (minted by POST /api/v1/api-keys; shown once at mint). role: account reaches the full account surface: the directory (domains, routes, patterns, api-keys, accounts, address lists) plus every mailbox the account owns. role: system additionally reaches the operator surface, which is documented separately.

oemp_… mailbox app password (minted by POST /api/v1/identities/{identityId}/credentials). Reaches ONE mailbox: its messages, labels, threads, search, sync, send, filters and PIM collections. Directory routes refuse it with 403 insufficient_scope.

Refusal vocabulary: a missing, malformed, expired, or revoked credential answers 401 unauthorized with a WWW-Authenticate: Bearer challenge; a VALID credential outside its scope answers 403 (insufficient_scope for an app password on a directory route, system_credentials_required where only the operator may call). The public routes (health, branding, token-in-path capabilities) declare security: [].

Path Parameters

accountId*string

Account ULID identifier

Response Body

Every plan limit's resolved threshold and enforcement state

application/json

response

accountId*string

Account ULID

billingTier*string

What the billing tool sold this account. Not a limit: Pro's numbers are stamped only once the account is also vetted (plan = trusted)

Value in"free""pro"

limits*

Every plan limit, keyed by its field name on GET and PATCH /accounts/:accountId, which describe what each bounds. Each NULL value follows its platform default: send* the ACCOUNT_SEND_* vars; mailboxSend* (the default for a mailbox with no override of its own, which comes first) the per-mailbox SEND_* vars; recvMsgsPerDay/recvBytesPerDay ACCOUNT_RECV_*; storageLimitBytes ACCOUNT_STORAGE_LIMIT_BYTES; maxMailboxes MAX_MAILBOXES_DEFAULT (no API stores 0 for it: positive or null; a row holding 0 anyway is a ceiling of zero, reported as limit 0, enforced, not as unlimited); mailboxCreatesPerDay, addressCreatesPerDay, domainCreatesPerDay MAX_{MAILBOX,ADDRESS,DOMAIN}_CREATES_PER_DAY and forwardMsgsPerDay FORWARD_MSGS_PER_DAY, each of which is also the limit's on switch; maxMailTemplates MAX_MAIL_TEMPLATES_DEFAULT, where a blank default is the built-in 50, so its limit is null only when unlimited. forwardMsgsPerDay is counted per domain: N domains get N x this

plan*|

The account's vetting label (untrusted, trusted, or a tooling tier's name; null = no plan recorded). Display only: the limits below describe the resolved thresholds and their enforcement state

Example Request

curl -X GET 'https://api.open.email/api/v1/accounts/string/limits'

Example ResponseSchema

{
  "accountId": "string",
  "billingTier": "free",
  "limits": {
    "addressCreatesPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "domainCreatesPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "forwardMsgsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "mailboxCreatesPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "mailboxSendMsgsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "mailboxSendMsgsPerHour": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "mailboxSendRcptsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "mailboxSendRcptsPerHour": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "maxMailTemplates": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "maxMailboxes": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "recvBytesPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "recvMsgsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "sendMsgsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "sendMsgsPerHour": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "sendRcptsPerDay": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "sendRcptsPerHour": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    },
    "storageLimitBytes": {
      "agreed": true,
      "enforcement": "enforced",
      "limit": 0,
      "value": 0
    }
  },
  "plan": "string"
}

Get an account's limits and enforcement state

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Authorization

Path Parameters

Response Body