Check the capacity before your next bulk review: up to 5,000 active service identities per organization and one running forensic investigation per account. These limits are referenced by section 4 of the Terms of Service and form part of them.
subjects up to 5,000 active service identities per organization (a distinct service and version counts once, replicas collapse to one, and identities retire after 30 days unseen). Higher volumes are available on request: [email protected].
One running forensic investigation per account.
There is no published per-request rate limit, and we would rather say that than print a number we do not enforce. The envelope above is expressed in identities and running investigations because those are what actually cost us; ordinary interactive use and scripted triage against your own subjects are not metered per call, and a bulk run over your own inventory is not something we are trying to stop.
What we reserve is the ability to throttle traffic that threatens shared infrastructure, and to cap identity cardinality. Neither is automated today; each would be a manual step we took and told you about, not a code path that fires on its own. Sustained usage beyond the envelope gets a conversation before it gets a limit: we tell you first, and the path forward is the On-Prem plan, where the whole system runs on your hardware inside your network and capacity is engineered to your scale. If you are planning something large, tell us first and we will size it with you: [email protected].