peinture applies a small number of protective limits. They exist to keep the service stable, not to meter usage.

Login throttling

Repeated failed logins are throttled: after a few failures for a given account and client, each further attempt is delayed with an exponential backoff (up to a few minutes) before the credentials are even checked. A throttled attempt returns unauthorized (1001). Successful logins are never delayed. Only auth.login is throttled; refresh, personal-access-token, and image calls are not.

Batch limits

The POST /rpc endpoint accepts JSON-RPC batches (an array of request objects), bounded as follows:

• at most 20 requests per batch — a larger batch is rejected before it is parsed;
• at most 4 requests execute concurrently;
• each method is capped at 10 seconds, so the worst-case batch completes well within the request timeout.

The single-method alias routes (POST /rpc/{method}) do not accept batches — send a batch to POST /rpc.

Body size

• POST /rpc and the authentication endpoints cap the request body at 1 MiB — more than enough for metadata and control-plane calls.
• POST /api/v1/images (upload) allows a much larger body (the configured upload maximum, 100 MB by default). An oversized body returns 413 Request Entity Too Large.

There are no per-second request quotas on the read/write methods; be a considerate client.