# Limits And Quotas

This page is the public quota reference for Hooksbase projects. Use it when you need to know whether an event workflow, agent trigger, replay, file upload, or observability stream fits the current project tier.

## Tier quota presets

Project quotas are seeded from the project tier. Enterprise projects can receive custom quotas from Hooksbase, but the public default is:

| Tier | Monthly deliveries | Ingest rate | Stored payloads | File storage | Backlog | Replay / 24h | History | Payload | | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | | Free | 5,000 | 3 req/s | 50 MB | 0 | 500 | 50 | 7 days | 3 days | | Starter | 25,000 | 10 req/s | 500 MB | 5 GB | 2,000 | 500 | 14 days | 7 days | | Pro | 250,000 | 25 req/s | 2 GB | 20 GB | 10,000 | 5,000 | 30 days | 14 days | | Business | 1,500,000 | 50 req/s | 5 GB | 100 GB | 25,000 | 15,000 | 30 days | 14 days | | Enterprise | 10,000,000 | 100 req/s | 10 GB | 500 GB | 50,000 | 50,000 | 30 days | 14 days |

Active webhooks are unlimited on every tier.

Monthly deliveries are project-level. Ingest rate, stored payload bytes, file storage bytes, backlog depth, replay volume, history retention, and payload retention can also be tightened per webhook by webhook quota overrides.

## Feature gates

| Capability | Free | Starter | Pro | Business | Enterprise | | --- | --- | --- | --- | --- | --- | | HTTP, email, and form ingest | Yes | Yes | Yes | Yes | Yes | | Raw file content from email/form ingest | Metadata only | Yes | Yes | Yes | Yes | | Provider packs | No | Yes | Yes | Yes | Yes | | Payload transforms | No | Yes | Yes | Yes | Yes | | Custom retry policies and outbound headers | No | Yes | Yes | Yes | Yes | | Recurring webhook schedules | No | Yes | Yes | Yes | Yes | | Bulk replay and bulk DLQ re-drive | No | Yes | Yes | Yes | Yes | | Typed non-HTTP destinations | No | No | Yes | Yes | Yes | | Strict FIFO, default delay, and throttling | No | No | Yes | Yes | Yes | | Operator alerting | No | No | Yes | Yes | Yes | | Audit log API | No | No | No | Yes | Yes | | Event drains | 0 | 0 | 1 | 3 | Unlimited |

Single delivery replay and single DLQ re-drive are available on every tier when the retained payload still exists and replay quota headroom is available.

## Payload and file limits

- HTTP ingest request bodies are capped at `10 MB`.
- Form ingest accepts `application/x-www-form-urlencoded` and `multipart/form-data`.
- Email and form files have a per-file limit of `15 MB`.
- Email and form ingest have a total file limit of `50 MB` per event.
- Free-tier projects keep file metadata only. They do not upload file content or emit `fileRef` objects.
- Paid projects store accepted file content while file-storage quota and payload retention allow it.
- `fileRef.url` values are signed for `7 days`. The authenticated file route remains the durable access path during retention.

Form uploads that exceed file limits return `413`. Email attachments that exceed file limits are kept as metadata only, so the email is not bounced just because an attachment was too large.

## Retention and analytics windows

History retention controls delivery, attempt, DLQ, replay, and audit-log rows. Payload retention controls retained source payloads, dispatch snapshots, and file objects. Replays fail with `409` when the required retained payload artifact is gone.

Analytics routes use fixed windows:

- `GET /v1/webhooks/{id}/metrics` supports `window=1h`, `24h`, `7d`, and `30d`
- `GET /v1/webhooks/{id}/backlog` supports the same `window` values
- both routes default to `24h` when `window` is omitted
- `GET /v1/usage` uses explicit `from` and `to` timestamps instead

DLQ export is cursor-paginated but each export page is capped at `20` rows and includes base64 payload bodies when retained source payloads are still available.

## Overage and quota failures

Paid projects can opt into monthly-delivery overage. Free projects are always hard-blocked at the monthly delivery limit.

Runtime quota failures use these status codes:

- `429` for ingest rate, replay volume, and monthly deliveries
- `409` for stored payload bytes, file storage bytes, and backlog depth
- `403` when the request uses a feature below the project tier

Quota error responses include the quota name, scope, limit, current usage, attempted delta, and optional `retryAfterSec`.

Related routes:

- `GET /v1/project`
- `PATCH /v1/project`
- `GET /v1/usage`
- `GET /v1/webhooks/{id}/metrics`
- `GET /v1/webhooks/{id}/backlog`
- `GET /v1/dlq/export`

## Common mistakes

- Treating the monthly delivery quota as a per-webhook limit. It is project-level.
- Expecting free-tier email or form uploads to persist file content. Free keeps metadata only.
- Waiting past payload retention and expecting replay to recover the original body.
- Using analytics `from`/`to` on metrics or backlog routes. Those routes use `window`.
- Assuming event drains are available on Starter. Drains start at Pro.