peinture applies a small number of protective limits. They exist to keep the service stable, not to meter usage.

## Login throttling

Repeated failed logins are throttled: after a few failures for a given account and client, each further attempt is delayed with an exponential backoff (up to a few minutes) before the credentials are even checked. A throttled attempt returns `unauthorized` (`1001`). Successful logins are never delayed. Only [`auth.login`](/docs/methods/auth.login) is throttled; refresh, personal-access-token, and image calls are not.

## Batch limits

The `POST /rpc` endpoint accepts JSON-RPC batches (an array of request objects), bounded as follows:

- at most **20** requests per batch — a larger batch is rejected before it is parsed;
- at most **4** requests execute concurrently;
- each method is capped at **10 seconds**, so the worst-case batch completes well within the request timeout.

The single-method alias routes (`POST /rpc/{method}`) do **not** accept batches — send a batch to `POST /rpc`.

## Body size

- `POST /rpc` and the authentication endpoints cap the request body at **1 MiB** — more than enough for metadata and control-plane calls.
- `POST /api/v1/images` (upload) allows a much larger body (the configured upload maximum, 100 MB by default). An oversized body returns `413 Request Entity Too Large`.

There are no per-second request quotas on the read/write methods; be a considerate client.