​

API governance console

​

What the console governs

• Requests per minute (rate limit). Per-minute throughput. An over-rate key gets 429 until the window rolls over — its own window, not the whole org’s.
• Monthly request quota. A hard ceiling per UTC month. Cross it and every further call returns 429 until the 1st.
• Monthly spend limit. A token-level budget in integer cents. Useful for capping a runaway key’s month-to-date spend before it runs into your wallet.
• Usage-alert threshold. An advisory percent of the monthly quota. Crossing it only flags the key in the console — it never blocks traffic.

​

How the console enforces a tier

1. Per-key override wins. If the key has a non-null field in its override, that value gates the key for that dimension.
2. Org-wide default fills the gap. Any dimension the override leaves null falls through to the org tier.
3. Platform floor. A dimension with no override and no org default resolves to the platform’s built-in bound — generous by design, so a well-behaved key never notices.

​

Why explicit beats inherit-on-default

​

Why the guard wraps before Redis

​

View and update flow

​

1. Open the page and read the org default

1. Open Developer → API governance.
2. In the Org-wide default card, set the fields you want — requests per minute, monthly request quota, and/or the usage-alert threshold.
3. Save. Only the fields you touch change; a blank field clears that setting.

​

2. Pick a key and set a per-key override

1. In the per-key table, find the key and click Set override (or Edit override on a key that already has one).
2. Enter a requests-per-minute value, a monthly quota, or both. Leave a field blank to inherit the org default for that dimension.
3. Save. To remove the override entirely, clear both fields and save — the key goes back to the org default.

​

3. Read the effective limits back

​

Pre-flight with the API

curl https://api.orbit.devotel.io/api/v1/developer/governance \
  -H "X-API-Key: dv_live_sk_..."

{
  "data": {
    "org_default": {
      "requests_per_minute": 6000,
      "monthly_request_quota": 10000000,
      "monthly_spend_limit_minor": 500000
    },
    "alert_threshold_percent": 80,
    "spend_alert_thresholds": [50, 80, 100],
    "bounds": {
      "max_requests_per_minute": 60000,
      "max_monthly_request_quota": 1000000000,
      "max_monthly_spend_limit_minor": 1000000000,
      "max_spend_alert_thresholds": 3
    },
    "keys": [
      {
        "api_key_id": "key_abc123",
        "name": "production-backend",
        "key_prefix": "dv_live_sk_prod",
        "last_four": "7c4d",
        "active": true,
        "effective_limits": {
          "requests_per_minute": 6000,
          "monthly_request_quota": 10000000,
          "monthly_spend_limit_minor": 500000
        },
        "override": null,
        "usage": {
          "requests_this_minute": 41,
          "requests_this_month": 812345
        },
        "monthly_quota": {
          "limit": 10000000,
          "used": 812345,
          "remaining": 9187655,
          "usage_percent": 8,
          "over_quota": false
        },
        "monthly_spend": {
          "limit_minor": 500000,
          "spent_minor": 1200,
          "usage_percent": 0,
          "over_limit": false
        },
        "alerting": false
      }
    ],
    "keys_truncated": false
  }
}

• Is the key listed? The read hydrates at most 250 keys — keys_truncated: true means the page cut the list and you should drive the API or revoke dormant keys.
• Is its effective_limits what you expected? If it shows a value you didn’t set, someone else changed the org default — read org_default first.
• Is override non-null? Writing to a key already carrying an override still overwrites it; the same tier always wins, field by field.

curl -X PUT https://api.orbit.devotel.io/api/v1/developer/governance/org \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "requests_per_minute": 6000,
    "monthly_request_quota": 10000000,
    "alert_threshold_percent": 80
  }'

curl -X PUT https://api.orbit.devotel.io/api/v1/developer/governance/keys/{keyId} \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{ "requests_per_minute": 1200, "monthly_request_quota": 500000 }'

​

A rate-limit planning checklist

• What’s your current usage? Read the This minute and This month counters on the busiest key — the org tier must be at least that, headroom included.
• What’s the noisy-neighbor argument for a tighter per-key lid? A stuck retry loop or a leaked credential should burn through that key’s own window, not the org’s.
• What’s the smallest quota that fits your monthly calendar? The monthly window resets on the 1st (UTC) — pick a quota shaped to months, not to arbitrary rolling windows.
• Which threshold should flag the key? A whole-percent advisory line (1–100) — set it low enough that an alert lands before the quota locks the key.
• Does any key deserve an explicit override? Only if one integration needs room the rest of the org doesn’t. Prefer the org tier; overrides multiply places you have to remember.

​

429 shapes to expect

• 429 RATE_LIMIT_EXCEEDED. Per-minute window exceeded. Retry-After: 60 plus details.limit, details.used, and the details.window: "1 minute" hint tell the client exactly how to back off.
• 429 QUOTA_EXCEEDED. Monthly request quota crossed. Retry when the month resets (UTC) or after raising the quota.

​

Troubleshooting

​

Permissions and audit