> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API rate limits & quotas console

> Set an org-wide default rate limit and monthly quota, override either per API key, and watch live usage and headroom — the value you save is enforced on the key's next request.

# API rate limits & quotas console

The **Developer → API governance** page in the dashboard is the self-serve console for the [per-key usage limits API](/guides/api-key-usage-limits): set the org-wide default, override a single key, and see what each key is doing right now — no support ticket, no `mailto:` hand-off.

You need the owner, admin, or developer role. Everyone else in the workspace sees the page but cannot change values.

## Org-wide default

The org-wide default is the tier every API key inherits unless it has its own override.

1. Open **Developer → API governance**.
2. In the **Org-wide default** card, set the fields you want:
   * **Requests per minute** — the per-minute rate limit each key inherits.
   * **Monthly request quota** — a hard ceiling per UTC month.
   * **Usage-alert threshold** — a whole-percent (1–100) line that flags a key before it exhausts its monthly quota. Advisory only; it never blocks traffic.
3. Save. Leave a field blank to clear that setting back to the platform default.

Values are bounded by platform maximums — the card shows the current bounds — and a value of `0` is rejected (a zero cap would hard-block the key; revoke it instead).

## Per-key override

Override either dimension for a single key when one integration needs more headroom — or a tighter lid — than the rest of the workspace.

1. In the per-key table, find the key and click **Set override** (or **Edit override** on a key that already has one).
2. Enter a requests-per-minute value, a monthly quota, or both. Leave a field blank to inherit the org default for that dimension.
3. Save. To remove the override entirely, clear both fields and save — the key goes back to the org default.

Keys with an override are marked **Override** in the table, next to the effective limits that actually gate the key.

## Live usage and headroom

The per-key table reports live counters per key:

* **This minute** — requests inside the current per-minute window.
* **This month** — requests since the 1st (UTC).
* **Headroom** — a bar showing usage against the effective monthly quota. A key crossing the usage-alert threshold is flagged; a key past quota is marked **Over quota** and starts receiving `429` until the month resets.

The counters refresh when you navigate or save a change; use **Refresh** to pull the latest numbers on demand. If your workspace has more than 250 active keys, the list is cut and the page tells you it was truncated.

## How an override propagates

A saved value is enforced on the very next request that key makes. The console's save invalidates the API-side governance cache, so there is no TTL to wait out — a `429`-ing key you just raised stops being rejected on its next call, and a key you tightened is bounded from its next call.

Every change is audit-logged: org-wide default and per-key override each produce an audit entry you can review under **Audit log**.

## Permissions

Reads and writes on this page require the owner, admin, or developer role. The same roles gate the underlying API (`/api/v1/developer/governance`), so a member who can open the page can also drive it from a script. Give this page to whoever owns your API keys — usually one or two admins — and keep rotating viewers on the read-only **API analytics** pages.