> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rerun.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Limits and guarantees

> What the API caps, what it refuses, and what it promises.

## Numbers

| Limit                                   | Value                               |
| --------------------------------------- | ----------------------------------- |
| Active API keys per workspace           | 20                                  |
| API key name                            | 60 characters                       |
| API key expiry                          | None. Revocation only               |
| Rate limit on the MCP endpoint          | None                                |
| `send_message` wait                     | 120 seconds by default, 600 maximum |
| `list_runs`                             | 20 runs by default, 200 maximum     |
| `db_query` and `space_db_query`         | 100 rows by default, 1000 maximum   |
| `list_connectors`                       | 60 per page by default, 200 maximum |
| Webhook request body                    | 1 MB                                |
| Payload handed to an agent by a webhook | 64 KB                               |
| Paid template price                     | \$5 minimum, \$2,000 maximum        |

Plan quotas still apply. `create_agent` succeeds when the workspace has no free agent slot, but the agent comes back with `active: false` and does not run until a slot frees up. See [Plans and billing](/billing).

## Scope

A key reaches one workspace, entirely. Every tool resolves its target through the same ownership check the app uses, so an `agentId` or a `spaceId` from another workspace comes back as `Agent not found` or `Box not found`, never as a partial answer.

There is no read-only key, no per-agent key and no per-tool permission. If you need a narrower blast radius, use a separate workspace.

## What the API refuses to do

<AccordionGroup>
  <Accordion title="Accept a secret">
    `attach_connector` declares a connector and stops there. API keys, OAuth sign-ins and passwords are entered by the account owner in the app, and they are stored on the Box, never in the Rerun database. `plan_template_capture` returns credential variable **names** only, never values.
  </Accordion>

  <Accordion title="Publish a template">
    `submit_template` moves a draft to review. Publishing is the Rerun team's decision. Payout onboarding needs a browser.
  </Accordion>

  <Accordion title="Manage the account">
    No billing, no plan change, no subscription, no member or invitation management, no workspace creation, no Box creation. Create a Box in the app first.
  </Accordion>

  <Accordion title="Manage API keys">
    You cannot mint or revoke a key over MCP. That would let a leaked key extend itself.
  </Accordion>

  <Accordion title="Reach agent memory or files">
    The API covers prompts, skills, schedules, triggers, connectors, databases and runs. Memory entries and workspace files are reached by the agent itself, or by you in the app.
  </Accordion>

  <Accordion title="Upload a file or generate an image">
    `add_template_image` takes a public https URL and re-hosts the bytes. Produce the image elsewhere.
  </Accordion>
</AccordionGroup>

## Guarantees

* **Destructive tools ask twice.** Seven tools refuse to run without `confirm: true`. See [Destructive tools](/api/protocol#destructive-tools).
* **Skills are written atomically.** `upsert_skill` stages the whole folder and swaps it in, so a failed call never leaves a half-written skill.
* **Multi-statement SQL is transactional.** `db_execute` and `space_db_execute` with `statements` apply all of them or none.
* **A tool error is readable.** Failures come back as `isError` results with a message written to be acted on, not as an opaque protocol error. See [Errors](/api/protocol#errors).
* **Renaming is safe.** Changing an agent `name` never moves its `handle`, so `@handle` references in other agents keep resolving.

## Availability

The MCP endpoint and the webhook front door run on the Rerun app. The agents themselves run on your Box. A Box that is shut down or restarting makes agent-facing tools fail with a reachability error, while catalog tools like `list_connectors` keep working.