Limits
Pagination
| Limit | Value | Behaviour when exceeded |
|---|---|---|
| Default page size | 25 | — |
| Maximum page size | 1000 | Rejected with 400, not silently reduced |
| Page beyond the last | — | Empty result set, not an error |
Rejecting an oversized page rather than clamping it is deliberate: a silently reduced page makes a caller believe it has seen everything.
Bulk submissions
| Limit | Value | Status when exceeded |
|---|---|---|
| Rows per submission | 10,000 | 400 TOO_MANY_ROWS |
| Absolute admission ceiling | 50,000 | 400 TOO_MANY_ROWS |
| Request body size | Server-configured | 413 |
Matching
| Limit | Value | Notes |
|---|---|---|
| Candidates per blocking lookup | 50 | Beyond this the lookup is capped; a similarity fallback applies when blocking yields too few |
| Active match profiles | 1 per entity type | Activating one deactivates its siblings atomically |
minAutoLinkAttributes | default 1, range 1–20 | Distinct attributes that must agree before auto-linking |
autoLinkWeight | default 10.0, range 0–100 | Log2 evidence units |
clericalReviewWeight | default 5.0, range 0–100 | Must be ≤ autoLinkWeight, enforced on save |
priorMatchProbability | default 0.00001, range 0–1 | Folded into the reported posterior only |
An over-broad blocking strategy fills those 50 slots with records sharing nothing meaningful, and the true match may not be among them. A matching run that is slow and finds little is usually a blocking problem, not a capacity problem.
Search
| Limit | Value | Notes |
|---|---|---|
| Default page size | 25 | |
| Maximum page size | 1000 | |
| Label-to-code expansion cap | 1000 | Results carry a truncation flag |
Truncation is signalled rather than erroring. A very short query is a legitimate prefix search, and failing it would be worse than returning best matches with an honest signal that more exist.
Tokens
| Property | Value |
|---|---|
| Access token lifetime | 86,400 seconds (one day) by default, configurable per environment |
| Refresh | Not implemented — reauthenticate when a token expires |
| Revocation | Immediate — the token identifier is checked against a revocation list on every request |
Token lifetime governs how often people re-authenticate, not how long a revocation takes to take effect.
Backpressure
Work beyond capacity is rejected with a retry interval, not queued indefinitely.
| Condition | Status |
|---|---|
| Per-tenant queue depth reached | 429 QUEUE_LIMIT_EXCEEDED |
| Per-tenant payload quota reached | 429 PAYLOAD_QUOTA_EXCEEDED |
| Rate limit reached | 429 RATE_LIMITED |
| Platform saturated | 503 QUEUE_SATURATED |
Both statuses carry a retry interval. Honour it — retrying immediately makes the condition worse. Rejection is the better failure: a queue that accepts everything grows until something worse happens.
Next
Last verified against commit 944761c7 (2026-08-03)