Limits and quotas

Use these bounds when you configure Balancer. A field constraint is separate from an account quota. A missing quota does not mean unlimited capacity.

Account and content limits

Limit	Value
Active custom lists per account	100
Active items per custom list	1000
Active custom-list items per account	10000
Custom-list items in one request	1000
Image policies per account	50
Image variants per policy	100
Image width or height	8192 pixels
Image pixel count	100000000
Image input size	67108864 bytes
Error-page body	131072 bytes
Rate-limit expression	8192 bytes
Rate-limit rule key	96 bytes
Rate-limit bucket fields	1 through 16
Rate-limit bucket field name	255 bytes
Rate-limit period	At most 86400 seconds; default 1 second
Rate-limit amount precision	3 decimal places
Source IP network prefix	API accepts up to 128; IPv4 runtime rejects values above 32
Session label key	96 bytes
HSTS maximum age	At most 63072000 seconds
HSTS preload minimum maximum-age	31536000 seconds
WAF expression branches	16
WAF predicates per branch	8
Request expression nesting	64 levels
Request expression wildcard stars	8
Compiled regular expression size	262144 bytes
Regular expression automaton size	524288 bytes
WAF inspection body	API: 1024 through 1048576 bytes
WAF body capture timeout	50 through 5000 ms
Challenge aggressiveness	0 through 5
Version precondition	0 through 9007199254740991

Declared field constraints

The tables below list numeric constraints and declared defaults for customer fields. For strings, minimum and maximum refer to length unless the field name or constraint states bytes. Serialized maximum applies to the serialized array. Required fields and defaults can differ by operation; an operation-specific default takes precedence over a shared declaration.

Accounts organizations users permissions

Field	Type	Bound	Shared default
issuer	string	maximum 255	Not declared here
audiences	stringArray	serialized maximum 1024	Not declared here
jwksUri	string	maximum 512	Not declared here
jwks	string	maximum 32768	Not declared here
forwardPayloadHeader	string	maximum 64	Not declared here
fromHeaders	stringArray	serialized maximum 255	Not declared here
fromParams	stringArray	serialized maximum 255	Not declared here
username	string	maximum 255	Not declared here
password	string	maximum 255	Not declared here
authorizationEndpoint	string	maximum 512	Not declared here
tokenEndpointUrl	string	maximum 512	Not declared here
clientId	string	maximum 255	Not declared here
clientSecret	string	maximum 4096	Not declared here
redirectUri	string	maximum 512	Not declared here
redirectPath	string	maximum 255	Not declared here
signoutPath	string	maximum 255	Not declared here
authScopes	stringArray	serialized maximum 4096	Not declared here
oauth.authorizationEndpoint	string	maximum 512	Not declared here
oauth.tokenEndpointUrl	string	maximum 512	Not declared here
oauth.clientId	string	maximum 255	Not declared here
oauth.clientSecret	string	maximum 4096	Not declared here
oauth.redirectUri	string	maximum 512	Not declared here
oauth.redirectPath	string	maximum 255	Not declared here
oauth.signoutPath	string	maximum 255	Not declared here
oauth.authScopes	stringArray	serialized maximum 4096	Not declared here
paginationLimit	integer	minimum 1; maximum 1000	Not declared here
paginationOffset	integer	minimum 0	Not declared here
paginationSearch	string	maximum 255	Not declared here

Block and allow policies custom lists

Field	Type	Bound	Shared default
countryCode	string	minimum 2; maximum 2	Not declared here
asn	integer	minimum 1; maximum 4294967295	Not declared here
blockPolicyRule.value	string	maximum 128	Not declared here
blockPolicyRule.name	string	maximum 64	Not declared here
blockPolicyRule.description	string	maximum 255	Not declared here
allowPolicyRule.value	string	maximum 128	Not declared here
allowPolicyRule.name	string	maximum 64	Not declared here
allowPolicyRule.description	string	maximum 255	Not declared here
customListName	string	maximum 64	Not declared here
customListItemValue	string	maximum 255	Not declared here
customListItemComment	string	maximum 255	Not declared here
customListItems	array	maximum 1000	Not declared here
customListItems[].value	string	maximum 255	Not declared here
customListItems[].comment	string	maximum 255	Not declared here

Caching cache policies purge

Field	Type	Bound	Shared default
debugHeadersCidrs	stringArray	maximum 32; serialized maximum 2048	Not declared here
cacheRulePriority	integer	minimum 1; maximum 100000000	Not declared here
edgeTtlSeconds	integer	minimum 0; maximum 2147483647	Not declared here
edgeStatusTtl[].statusCodeFrom	integer	minimum 100; maximum 599	Not declared here
edgeStatusTtl[].statusCodeTo	integer	minimum 100; maximum 599	Not declared here
edgeStatusTtl[].ttlSeconds	integer	minimum 0; maximum 2147483647	Not declared here
browserTtlSeconds	integer	minimum 0; maximum 2147483647	Not declared here
staleWhileRevalidateSeconds	integer	minimum 0; maximum 2147483647	Not declared here
keepSeconds	integer	minimum 0; maximum 2147483647	Not declared here
cacheControlDirectiveActions	array	maximum 32; serialized maximum 4096	Not declared here
cacheControlDirectiveActions[].directive	string	maximum 64	Not declared here
cacheControlDirectiveActions[].seconds	integer	minimum 0; maximum 2147483647	Not declared here

Ddos protection behaviour visible to customers

Field	Type	Bound	Shared default
wafAllowPolicyRule.name	string	maximum 64	Not declared here
wafAllowPolicyRule.description	string	maximum 255	Not declared here
wafAllowPolicyRule.requestExpression	string	maximum 8192	Not declared here
wafDearmPrimaryRuleId	integer	minimum 1	Not declared here
crsParanoiaLevel	integer	minimum 1; maximum 4	Not declared here
wafPriority	integer	minimum 1; maximum 100000000	Not declared here
defaultWafBodyInspectionLimitBytes	integer	minimum 1024; maximum 1048576	Not declared here
defaultWafBodyCaptureTimeoutMs	integer	minimum 50; maximum 5000	Not declared here
wafBodyInspectionLimitBytes	integer	minimum 1024; maximum 1048576	Not declared here
wafBodyCaptureTimeoutMs	integer	minimum 50; maximum 5000	Not declared here
wafRuleLabel	string	maximum 64	Not declared here
wafRuleText	string	maximum 16384	Not declared here
wafExpressionText	string	maximum 8192	Not declared here
wafExpressionAction.message	string	maximum 255	Not declared here
wafRulePhase	integer	minimum 1; maximum 2	Not declared here
securityHeaders.strictTransportSecurity.maxAgeSeconds	integer	minimum 0; maximum 63072000	Not declared here
wafStatisticsTopRulesLimit	integer	minimum 0; maximum 100	Not declared here
wafStatisticsTopRulesetsLimit	integer	minimum 0; maximum 100	Not declared here
rateLimitRulePriority	integer	minimum 1; maximum 100000000	Not declared here
rateLimitPolicyRule.ruleId	string	maximum 96	Not declared here
rateLimitPolicyRule.name	string	maximum 64	Not declared here
rateLimitPolicyRule.description	string	maximum 255	Not declared here
rateLimitPolicyRule.requestExpression	string	maximum 8192	Not declared here
rateLimitPolicyRule.bucketBy	array	minimum 1; maximum 16	Not declared here
rateLimitPolicyRule.bucketBy[].name	string	maximum 255	Not declared here
rateLimitPolicyRule.bucketBy[].prefix	integer	minimum 0; maximum 128	Not declared here
rateLimitPolicyRule.limit.periodSeconds	integer	minimum 1; maximum 86400	Not declared here
rateLimitPolicyRule.limit.period.value	integer	minimum 1; maximum 86400	Not declared here
rateLimitPolicyRule.charge.requestCost.weightMillis	integer	minimum 0	Not declared here
rateLimitPolicyRule.challengeModifier.value	integer	minimum 0; maximum 5	Not declared here
rateLimitPolicyRule.challengeModifier.thresholdPercent	integer	minimum 0; maximum 100	Not declared here

Dns zones records

Field	Type	Bound	Shared default
dnsZoneName	string	maximum 255	Not declared here
dnsRecordName	string	maximum 255	Not declared here
dnsRecordContent	string	maximum 4096	Not declared here
dnsRecordTtl	integer	minimum 60; maximum 86400	Not declared here
dnsRecordPriority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordListSearch	string	maximum 255	Not declared here
dnsRecordListName	string	maximum 255	Not declared here
dnsRecordListFqdn	string	maximum 255	Not declared here
dnsRecordListContent	string	maximum 4096	Not declared here
dnsRecordMx.target	string	maximum 255	Not declared here
dnsRecordMx.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordSrv.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordSrv.weight	integer	minimum 0; maximum 65535	Not declared here
dnsRecordSrv.port	integer	minimum 1; maximum 65535	Not declared here
dnsRecordSrv.target	string	maximum 255	Not declared here
dnsRecordCaa.flags	integer	minimum 0; maximum 255	Not declared here
dnsRecordCaa.value	string	maximum 255	Not declared here
dnsRecordWrite.name	string	maximum 255	Not declared here
dnsRecordWrite.ttl	integer	minimum 60; maximum 86400	Not declared here
dnsRecordWrite.content	object	minimum 1; maximum 1	Not declared here
dnsRecordWrite.content.raw.value	string	maximum 4096	Not declared here
dnsRecordWrite.content.raw.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordWrite.content.mx.target	string	maximum 255	Not declared here
dnsRecordWrite.content.mx.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordWrite.content.srv.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordWrite.content.srv.weight	integer	minimum 0; maximum 65535	Not declared here
dnsRecordWrite.content.srv.port	integer	minimum 1; maximum 65535	Not declared here
dnsRecordWrite.content.srv.target	string	maximum 255	Not declared here
dnsRecordWrite.content.caa.flags	integer	minimum 0; maximum 255	Not declared here
dnsRecordWrite.content.caa.value	string	maximum 255	Not declared here
dnsRecordPatch.name	string	maximum 255	Not declared here
dnsRecordPatch.ttl	integer	minimum 60; maximum 86400	Not declared here
dnsRecordPatch.content	object	minimum 1; maximum 1	Not declared here
dnsRecordPatch.content.raw.value	string	maximum 4096	Not declared here
dnsRecordPatch.content.raw.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordPatch.content.mx.target	string	maximum 255	Not declared here
dnsRecordPatch.content.mx.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordPatch.content.srv.priority	integer	minimum 0; maximum 65535	Not declared here
dnsRecordPatch.content.srv.weight	integer	minimum 0; maximum 65535	Not declared here
dnsRecordPatch.content.srv.port	integer	minimum 1; maximum 65535	Not declared here
dnsRecordPatch.content.srv.target	string	maximum 255	Not declared here
dnsRecordPatch.content.caa.flags	integer	minimum 0; maximum 255	Not declared here
dnsRecordPatch.content.caa.value	string	maximum 255	Not declared here

Error pages

Field	Type	Bound	Shared default
errorPageAssetName	string	maximum 64	Not declared here
errorPageAssetDescription	string	maximum 255	Not declared here
errorPageAssetBody	string	maximum 131072	Not declared here
errorPageStatusMatch	string	maximum 8	Not declared here
errorPageResponseStatusCode	integer	minimum 400; maximum 599	Not declared here

Http load balancers groups routes

Field	Type	Bound	Shared default
httpRoutePriority	integer	minimum 1; maximum 100000000	Not declared here
matchKey	string	maximum 255	Not declared here
matchValue	string	maximum 255	Not declared here
stickySessionsHeader	string	maximum 128	Not declared here
retry.count	integer	minimum 0; maximum 10	Not declared here
originRequest.hostHeader.value	string	maximum 255	Not declared here
originTls.sni.value	string	maximum 255	Not declared here
routeRequestExpression	string	maximum 8192	Not declared here
challengePage.imageDataUrl	string	maximum 131072	Not declared here
challengePage.text	string	maximum 1024	Not declared here
challengePage.customCss	string	maximum 4096	Not declared here
domain	string	maximum 255	Not declared here
backendPort	integer	minimum 1; maximum 65535	Not declared here
downstreamCaCertificate	string	maximum 32768	Not declared here
requestTimeoutMilliseconds	integer	minimum 1; maximum 3600000	15000
idleTimeoutMilliseconds	integer	minimum 1; maximum 3600000	300000
perTryTimeoutMilliseconds	integer	minimum 1; maximum 300000	Not declared here
connectTimeoutMilliseconds	integer	minimum 1; maximum 120000	Not declared here
healthCheck.active.domain	string	maximum 255	Not declared here
healthCheck.active.path	string	maximum 255	Not declared here
healthCheck.active.port	integer	minimum 1; maximum 65535	Not declared here
healthCheck.active.intervalSeconds	integer	minimum 10; maximum 3600	Not declared here
healthCheck.active.triesPerCheck	integer	minimum 1; maximum 10	Not declared here
healthCheck.active.retryDelaySeconds	integer	minimum 1; maximum 60	Not declared here
healthCheck.active.timeoutMilliseconds	integer	minimum 1000; maximum 60000	Not declared here
healthCheck.active.matchHttpString	string	maximum 64	Not declared here
healthCheck.active.minimumConsecutiveFailures	integer	minimum 1; maximum 10	Not declared here
healthCheck.active.minimumConsecutiveSuccesses	integer	minimum 1; maximum 10	Not declared here
healthCheck.active.maxRedirects	integer	minimum 0; maximum 10	Not declared here
healthCheck.passive.failDuration	integer	minimum 1; maximum 3600	Not declared here
healthCheck.passive.maxFails	integer	minimum 1; maximum 100	Not declared here
healthCheck.passive.statuses	string	maximum 255	Not declared here
healthCheck.passive.maxFailDurationMs	integer	minimum 1; maximum 3600000	Not declared here
healthyPanicThreshold	integer	minimum 0; maximum 100	Not declared here
performanceThresholds.probeWindowMinutes	integer	minimum 1; maximum 10080	Not declared here
performanceThresholds.minimumResponseTimePercent	integer	minimum 1; maximum 100	Not declared here
performanceThresholds.maximumResponseTimeMs	integer	minimum 1; maximum 300000	Not declared here
performanceThresholds.minimumUptimePercent	integer	minimum 1; maximum 100	Not declared here
trafficWeight	integer	minimum 0; maximum 100	100
mirror.backendPort	integer	minimum 1; maximum 65535	Not declared here
mirror.percent	integer	minimum 0; maximum 100	100

Image manipulation

Field	Type	Bound	Shared default
imageManipulationPrefix	string	maximum 64	Not declared here
defaultImageManipulationVariant	string	maximum 64	Not declared here
imageManipulationStatisticsFilters.variant	stringArray	maximum 32; serialized maximum 2048	Not declared here
imageManipulationStatisticsFilters.cacheOutcome	stringArray	maximum 8; serialized maximum 512	Not declared here
imageManipulationStatisticsFilters.sourceFormat	stringArray	maximum 16; serialized maximum 512	Not declared here
imageManipulationStatisticsFilters.outputFormat	stringArray	maximum 16; serialized maximum 512	Not declared here
canonicalOpsString	string	maximum 256	Not declared here
maxWidth	integer	minimum 1; maximum 8192	Not declared here
maxHeight	integer	minimum 1; maximum 8192	Not declared here
maxPixels	integer	minimum 1; maximum 100000000	Not declared here
maxInputBytes	integer	minimum 1; maximum 67108864	Not declared here
maxDpr	number	minimum 1; maximum 5	Not declared here
minQuality	integer	minimum 1; maximum 100	Not declared here
maxQuality	integer	minimum 1; maximum 100	Not declared here
maxBlurSigma	number	minimum 0.3; maximum 10	Not declared here
maxSharpenSigma	number	minimum 0.5; maximum 5	Not declared here
defaultQualityJpeg	integer	minimum 1; maximum 100	Not declared here
defaultQualityWebp	integer	minimum 1; maximum 100	Not declared here
defaultQualityAvif	integer	minimum 1; maximum 100	Not declared here
defaultQualityJxl	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.min	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.max	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.defaults.jpeg	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.defaults.webp	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.defaults.avif	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.quality.defaults.jxl	integer	minimum 1; maximum 100	Not declared here
imageManipulationOps.dpr.max	number	minimum 1; maximum 5	Not declared here
imageManipulationOps.blur.maxSigma	number	minimum 0.3; maximum 10	Not declared here
imageManipulationOps.sharpen.maxSigma	number	minimum 0.5; maximum 5	Not declared here
imageManipulationBounds.maxWidth	integer	minimum 1; maximum 8192	Not declared here
imageManipulationBounds.maxHeight	integer	minimum 1; maximum 8192	Not declared here
imageManipulationBounds.maxPixels	integer	minimum 1; maximum 100000000	Not declared here
imageManipulationBounds.maxInputBytes	integer	minimum 1; maximum 67108864	Not declared here

L4 load balancers

Field	Type	Bound	Shared default
listenPort	integer	minimum 1; maximum 65535	Not declared here
idleTimeoutSeconds	integer	minimum 1; maximum 86400	3600
internalPort	integer	minimum 1; maximum 65535	Not declared here

Limits and quotas

Field	Type	Bound	Shared default
nglbName	string	minimum 1; maximum 64	Not declared here
nglbDescription	string	maximum 255	Not declared here
nglbCertificate	string	maximum 32768	Not declared here
nglbPrivateKey	string	maximum 16384	Not declared here
accessLogQueryFilters.sentryTraceId	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.requestId	stringArray	maximum 16; serialized maximum 4096	Not declared here
accessLogQueryFilters.cachePolicyId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.popId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.clusterId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.sourceAsn	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.method	stringArray	maximum 16; serialized maximum 512	Not declared here
accessLogQueryFilters.host	stringArray	maximum 32; serialized maximum 4096	Not declared here
accessLogQueryFilters.normalizedPath	stringArray	maximum 32; serialized maximum 8192	Not declared here
accessLogQueryFilters.responseStatus	intArray	maximum 32; innerMinimum 100	Not declared here
accessLogQueryFilters.responseStatusClass	intArray	maximum 8; innerMinimum 1	Not declared here
accessLogQueryFilters.cacheOutcome	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.wafOutcome	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.wafAction	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.wafFirewallId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.wafPrimaryRuleId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.wafBodyCaptureStatus	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.wafBodyInspectionLimitBytes	intArray	maximum 32; innerMinimum 1	Not declared here
accessLogQueryFilters.icpAction	stringArray	maximum 16; serialized maximum 1024	Not declared here
accessLogQueryFilters.rateLimitPolicyRuleId	intArray	maximum 50; innerMinimum 1	Not declared here
accessLogQueryFilters.blockPolicyRuleId	intArray	maximum 50; innerMinimum 1	Not declared here
metricsTimeRange.pastMinutes	integer	minimum 5; maximum 525960	Not declared here
metricsTimezone	string	maximum 64	Not declared here
metricsQueryLimit	integer	minimum 1; maximum 1000	Not declared here
metricsCursor	string	maximum 4096	Not declared here
metricsMetricNames	stringArray	maximum 50	Not declared here

Additional operation constraints

These constraints come from operation arguments. Nested field names include their parent object. Bounds for identifiers validate supplied values, rather than limiting the number of resources.

Operation family	Field	Type	Bound
organizations	account.accountId	integer	minimum 1
accounts	account.defaultApiKeyMaxAgeSeconds	integer	minimum 1
accounts	account.defaultJwtTtlSeconds	integer	minimum 1
accounts, auth	account.name	string	maximum 64; minimum 1
accounts, organizations	accountId	integer	minimum 1
accounts	accountUser.apiKeyMaxAgeSeconds	integer	minimum 1
accounts	accountUser.jwtTtlSeconds	integer	minimum 1
accounts, organizations	accountUserId	integer	minimum 1
waf-rulesets	action.challengeModifier.value	integer	maximum 5; minimum 0
waf-rulesets	action.message	string	maximum 255
auth, user	apiKey.description	string	maximum 255
auth, user	apiKey.name	string	maximum 64; minimum 1
user	apiKeyId	integer	minimum 1
accounts	apiSurfaceFallback.grantee.granteeId	integer	minimum 1
accounts	apiSurfaceFallbackId	integer	minimum 1
accounts	apiSurfaceGrant.grantee.granteeId	integer	minimum 1
accounts	apiSurfaceGrantId	integer	minimum 1
error-page-assets	body	string	maximum 131072; maxUtf8Bytes 131072; minUtf8Bytes 1
image-manipulation-policies	bounds.maxHeight	integer	maximum 8192; minimum 1
image-manipulation-policies	bounds.maxInputBytes	integer	maximum 67108864; minimum 1
image-manipulation-policies	bounds.maxPixels	integer	maximum 100000000; minimum 1
image-manipulation-policies	bounds.maxWidth	integer	maximum 8192; minimum 1
cache-policies	cacheControlDirectiveActions.directive	string	maximum 64
cache-policies	cacheControlDirectiveActions.seconds	integer	maximum 2147483647; minimum 0
accounts, organizations	capabilityGrant.grantee.granteeId	integer	minimum 1
accounts, organizations	capabilityGrantId	integer	minimum 1
http-loadbalancers	challengeAggressiveness	integer	maximum 5; minimum 0
user	challengeId	integer	minimum 1
auth, user	code	string	maximum 6; minimum 6
custom-lists	comment	string	maximum 255
auth	context.accountId	integer	minimum 1
auth	context.mbId	integer	minimum 1
auth	context.organizationId	integer	minimum 1
http-loadbalancers	cursor	string	maximum 4096
allow-policies, block-policies, cache-policies, custom-lists, error-page-assets, http-loadbalancers, l4-loadbalancers, mtls-certificates, rate-limit-policies, ssl-certificates, upstream-groups, waf-allow-policies, waf-firewalls, waf-rulesets	description	string	maximum 255
cache-policies	edgeStatusTtl.statusCodeFrom	integer	maximum 599; minimum 100
cache-policies	edgeStatusTtl.statusCodeTo	integer	maximum 599; minimum 100
cache-policies	edgeStatusTtl.ttlSeconds	integer	maximum 2147483647; minimum 0
auth	email	string	maximum 255; minimum 3
waf-rulesets	expressionText	string	maximum 8192; max_bytes 8192
http-loadbalancers	filters.blockPolicyRuleId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.cacheOutcome	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.cacheOutcome	stringArray	maximum 8; serialized maximum 512
http-loadbalancers	filters.cachePolicyId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.clusterId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.host	stringArray	maximum 32; serialized maximum 4096
http-loadbalancers	filters.icpAction	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.method	stringArray	maximum 16; serialized maximum 512
http-loadbalancers	filters.normalizedPath	stringArray	maximum 32; serialized maximum 8192
http-loadbalancers	filters.outputFormat	stringArray	maximum 16; serialized maximum 512
http-loadbalancers	filters.popId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.rateLimitPolicyRuleId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.requestId	stringArray	maximum 16; serialized maximum 4096
http-loadbalancers	filters.responseStatus	intArray	innerMinimum 100; maximum 32
http-loadbalancers	filters.responseStatusClass	intArray	innerMinimum 1; maximum 8
http-loadbalancers	filters.sentryTraceId	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.sourceAsn	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.sourceFormat	stringArray	maximum 16; serialized maximum 512
http-loadbalancers	filters.variant	stringArray	maximum 32; serialized maximum 2048
http-loadbalancers	filters.wafAction	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.wafBodyCaptureStatus	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.wafBodyInspectionLimitBytes	intArray	innerMinimum 1; maximum 32
http-loadbalancers	filters.wafFirewallId	intArray	innerMinimum 1; maximum 50
http-loadbalancers	filters.wafOutcome	stringArray	maximum 16; serialized maximum 1024
http-loadbalancers	filters.wafPrimaryRuleId	intArray	innerMinimum 1; maximum 50
accounts, organizations	granteeId	integer	minimum 1
http-loadbalancers	idleTimeoutMilliseconds	integer	maximum 3600000; minimum 0
http-loadbalancers	ifVersion	integer	maximum 9007199254740991; minimum 0
dns-zones, error-page-assets, log-export-destination, mtls-certificates, ssl-certificates, upstream-groups	ifVersion	integer	minimum 0
cache-policies, image-manipulation-policies	ifVersion	integer or decimal integer string	maximum 9007199254740991; minimum 0
allow-policies, block-policies, custom-lists, rate-limit-policies, waf-allow-policies, waf-firewalls, waf-rulesets	ifVersion	integer or decimal string	maximum 9007199254740991; minimum 0
accounts, organizations	invitation.email	string	maximum 255; minimum 3
accounts, organizations, user	invitationId	integer	minimum 1
custom-lists	items	array	maximum 1000
custom-lists	items.comment	string	maximum 255
custom-lists	items.value	string	maximum 255
waf-rulesets	label	string	maximum 64
accounts, allow-policies, block-policies, cache-policies, custom-lists, dns-zones, edges, error-page-assets, http-loadbalancers, image-manipulation-policies, l4-loadbalancers, mtls-certificates, organizations, rate-limit-policies, ssl-certificates, upstream-groups, user, waf-allow-policies, waf-firewalls, waf-rulesets	limit	integer	maximum 1000; minimum 1
log-export-destination	logExportDestination.accessKeyId	string	maximum 4096; minimum 1
log-export-destination	logExportDestination.bucket	string	maximum 255; minimum 1
log-export-destination	logExportDestination.endpoint	string	maximum 512; minimum 1
log-export-destination	logExportDestination.logLocationId	integer	minimum 1
log-export-destination	logExportDestination.name	string	maximum 128; minimum 1
log-export-destination	logExportDestination.prefix	string	maximum 1024
log-export-destination	logExportDestination.region	string	maximum 64; minimum 1
log-export-destination	logExportDestination.serverSideEncryptionKeyId	string	maximum 4096; minimum 1
accounts	member.accountUserId	integer	minimum 1
user	mfaFactor.name	string	maximum 64; minimum 1
user	mfaFactorId	integer	minimum 1
dns-zones	name	string	maximum 255
allow-policies, block-policies, cache-policies, image-manipulation-policies, rate-limit-policies, waf-allow-policies, waf-firewalls, waf-rulesets	name	string	maximum 64; minimum 1
custom-lists, error-page-assets, http-loadbalancers, l4-loadbalancers, mtls-certificates, ssl-certificates, upstream-groups	name	string	maximum 64
accounts, allow-policies, block-policies, cache-policies, custom-lists, dns-zones, edges, error-page-assets, http-loadbalancers, image-manipulation-policies, l4-loadbalancers, mtls-certificates, organizations, rate-limit-policies, ssl-certificates, upstream-groups, user, waf-allow-policies, waf-firewalls, waf-rulesets	offset	integer	minimum 0
image-manipulation-policies	ops.blur.maxSigma	number	maximum 10; minimum 0.3
image-manipulation-policies	ops.dpr.max	number	maximum 5; minimum 1
image-manipulation-policies	ops.quality.defaults.avif	integer	maximum 100; minimum 1
image-manipulation-policies	ops.quality.defaults.jpeg	integer	maximum 100; minimum 1
image-manipulation-policies	ops.quality.defaults.jxl	integer	maximum 100; minimum 1
image-manipulation-policies	ops.quality.defaults.webp	integer	maximum 100; minimum 1
image-manipulation-policies	ops.quality.max	integer	maximum 100; minimum 1
image-manipulation-policies	ops.quality.min	integer	maximum 100; minimum 1
image-manipulation-policies	ops.sharpen.maxSigma	number	maximum 5; minimum 0.5
auth, organizations	organization.name	string	maximum 64; minimum 1
organizations	organizationId	integer	minimum 1
organizations	organizationUserId	integer	minimum 1
http-loadbalancers	originLocationId	integer	minimum 1
auth	password	string	maximum 1024; minimum 1
auth	passwordReset.email	string	maximum 255; minimum 3
auth	passwordReset.password	string	maximum 1024; minimum 12
waf-firewalls	primaryRuleId	integer	minimum 1
cache-policies, http-loadbalancers, rate-limit-policies, waf-firewalls, waf-rulesets	priority	integer	maximum 100000000; minimum 1
dns-zones	record.content	object	maximum 1; minimum 1
dns-zones	record.content.caa.flags	integer	maximum 255; minimum 0
dns-zones	record.content.caa.value	string	maximum 255
dns-zones	record.content.mx.priority	integer	maximum 65535; minimum 0
dns-zones	record.content.mx.target	string	maximum 255
dns-zones	record.content.raw.priority	integer	maximum 65535; minimum 0
dns-zones	record.content.raw.value	string	maximum 4096
dns-zones	record.content.srv.port	integer	maximum 65535; minimum 1
dns-zones	record.content.srv.priority	integer	maximum 65535; minimum 0
dns-zones	record.content.srv.target	string	maximum 255
dns-zones	record.content.srv.weight	integer	maximum 65535; minimum 0
dns-zones	record.name	string	maximum 255
dns-zones	record.ttl	integer	maximum 86400; minimum 60
ssl-certificates	recordName	string	maximum 255
auth	recoveryCode	string	maximum 64; minimum 1
http-loadbalancers	requestExpression	string	maximum 8192
rate-limit-policies	requestExpression	string	max_bytes 8192; min_bytes 1
http-loadbalancers	requestTimeoutMilliseconds	integer	maximum 3600000; minimum 0
accounts	resourceId	integer	minimum 1
accounts	resourcePermission.grantee.granteeId	integer	minimum 1
accounts	resourcePermission.resource.resourceId	integer	minimum 1
accounts	resourcePermissionId	integer	minimum 1
http-loadbalancers	responseStatusCode	integer	maximum 599; minimum 400
rate-limit-policies	rule.bucketBy	array	maximum 16; minimum 1
rate-limit-policies	rule.bucketBy.name	string	maximum 255
rate-limit-policies	rule.bucketBy.prefix	integer	maximum 128; minimum 0
rate-limit-policies	rule.challengeModifier.thresholdPercent	integer	maximum 100; minimum 0
rate-limit-policies	rule.challengeModifier.value	integer	maximum 5; minimum 0
rate-limit-policies	rule.charge.requestCost.weightMillis	integer	minimum 0
allow-policies, block-policies, rate-limit-policies, waf-allow-policies	rule.description	string	maximum 255
rate-limit-policies	rule.limit.amount	number	decimal_places 3; exclusive_min 0
rate-limit-policies	rule.limit.period.value	integer	maximum 86400; minimum 1
rate-limit-policies	rule.limit.periodSeconds	integer	maximum 86400; minimum 1
allow-policies, block-policies, rate-limit-policies, waf-allow-policies	rule.name	string	maximum 64
rate-limit-policies, waf-allow-policies	rule.requestExpression	string	maximum 8192
rate-limit-policies	rule.ruleId	string	maximum 96; max_bytes 96
allow-policies, block-policies	rule.value	string	maximum 128
waf-rulesets	ruleText	string	maximum 16384; max_bytes 16384
accounts, allow-policies, block-policies, cache-policies, custom-lists, edges, error-page-assets, http-loadbalancers, image-manipulation-policies, l4-loadbalancers, mtls-certificates, organizations, rate-limit-policies, upstream-groups, user, waf-allow-policies, waf-firewalls, waf-rulesets	search	string	maximum 255
http-loadbalancers	sessionLabelKey	string	maximum 96
accounts, organizations	ssoProvider.discoverySlug	string	maximum 255; minimum 3
accounts, organizations	ssoProvider.emailDomain	string	maximum 255; minimum 3
accounts, organizations	ssoProvider.name	string	maximum 64; minimum 1
accounts, organizations	ssoProviderId	integer	minimum 1
http-loadbalancers	statusMatch	string	maximum 8
accounts	team.apiKeyMaxAgeSeconds	integer	minimum 1
accounts, organizations	team.description	string	maximum 255
accounts	team.jwtTtlSeconds	integer	minimum 1
accounts, organizations	team.name	string	maximum 64; minimum 1
accounts, organizations	teamId	integer	minimum 1
http-loadbalancers	timeRange.pastMinutes	integer	maximum 525960; minimum 5
http-loadbalancers	timezone	string	maximum 64
http-loadbalancers	topRulesLimit	integer	maximum 100; minimum 0
http-loadbalancers	topRulesetsLimit	integer	maximum 100; minimum 0
auth, user	user.email	string	maximum 255; minimum 3
auth, user	user.firstName	string	maximum 64; minimum 1
auth, user	user.lastName	string	maximum 64; minimum 1
auth	user.password	string	maximum 1024; minimum 12
auth, user	user.phone	string	maximum 32; minimum 3
user	user.preferences.dashboardDefaults	object	maximum 20
user	user.preferences.firstDayOfWeek	integer	maximum 6; minimum 0
auth, user	user.preferences.locale	string	maximum 32; minimum 2
auth, user	user.preferences.timezone	string	maximum 64; minimum 1
custom-lists	value	string	maximum 255

Limits requiring verification

TODO(verify): Classify remaining numeric inventory candidates and confirm every customer-reachable runtime bound, including aggregate configuration size, request headers, credential input sizes, concurrency admission and bucket cardinality defaults. The inventory alone does not establish units, enforcement scope or account overrides for all candidates.

TODO(verify): Confirm account-specific object quotas for load balancers, groups, routes, origins, policies and certificates. Do not infer unlimited capacity from an absent published number.