{
  "per_ip_requests_per_minute": 300,
  "per_account_requests_per_minute": 1200,
  "mcp_batch_max_messages": 20,
  "json_body_max_bytes": 65536,
  "operations": {
    "json_body_max_bytes": 1048576,
    "case_verification_json_body_max_bytes": 4194304,
    "batch_max_events": 100,
    "reconcile_max_keys": 100,
    "credential_requests_per_utc_day": 100000,
    "contract": "https://www.a2ally.com/v1/operations/spec"
  },
  "fair_use_quotas_per_day": {
    "quotas": {
      "anon": {
        "light": 2000,
        "standard": 100,
        "heavy": 0
      },
      "key": {
        "light": 10000,
        "standard": 1000,
        "heavy": 5
      },
      "kya": {
        "light": 100000,
        "standard": 10000,
        "heavy": 100
      }
    },
    "classes": {
      "light": "basic checks, lookups and reads — the free-forever surface",
      "standard": "batch items, manifests and receipts, evidence exports",
      "heavy": "git probes and code anchors, premium deep assessments, snapshot and mirror downloads"
    },
    "over_quota": "429 fair_use_quota_exceeded with Retry-After; quotas are per cost class and reset at 00:00 UTC",
    "heavy_gates": "heavy operations are never anonymous (an account API key is required), sandbox keys are excluded, and while projected hosting cost is in a breaker band they also require a KYA-verified account (RS-KYA L1 or above)",
    "cost_guard": {
      "thresholds_usd": {
        "yellow": 15,
        "orange": 30,
        "red": 40
      },
      "state": "https://www.a2ally.com/v1/policy/cost-guard",
      "note": "Breaker bands tighten only the free surface's volume: anonymous quotas halve at yellow, heavy pauses below L1 at orange, and red is the published $40 collection-trigger zone. Basic checks answer identically in every band."
    }
  },
  "registry_reads_per_day": {
    "per_ip_without_key": 2000,
    "per_account": 20000,
    "counts": "each registry lookup, each entry of POST /v1/registry/lookup-batch, certificate and history reads, and the plate page; browsing the newest list counts once",
    "header": "a2ally-Registry-Reads-Remaining",
    "over_limit": "429 registry_quota_exceeded with Retry-After"
  },
  "headers": [
    "RateLimit-Limit",
    "RateLimit-Remaining",
    "RateLimit-Reset",
    "Retry-After (on 429)",
    "a2ally-Registry-Reads-Remaining (registry reads)"
  ],
  "note": "Each message in an MCP batch counts as one request. Rate-limited requests are part of an agent's conduct record, so pace by RateLimit-Remaining. The registry is free to query, not to copy: bulk export is not offered."
}