PolyAccounts · Service
Limits, quotas and service levels
What an agent or an integrator can rely on: request sizes, timeouts, pagination, credential lifetimes, sandbox quotas, read metering (none) and the early-access service posture.
Requests and reads
Agent reads are not metered and are not billed. Fair-use limits exist to protect the shared service and are listed here so an agent can plan around them rather than discover them.
| Limit | Value |
|---|---|
| Agent request body | 256 KB |
| Read transaction statement timeout | 15 seconds, repeatable-read, read-only, UTC |
| ledger_entries pagination | Keyset cursors bound to company and filters; follow next_cursor |
| Trial balance detail cap | 2,000 accounts; totals always cover all accounts |
| Remote MCP tools/call timeout | 90 seconds |
| Read metering | None |
Credentials and OAuth
Every access path issues the same company-scoped agent credential. Credentials are bound to the issuing administrator and are denied when that administrator is removed, suspended, changes company, loses the role or resets their password.
| Item | Value |
|---|---|
| Credential expiry from Settings | 1 to 365 days, default 90 |
| OAuth access token | A 90-day agent credential |
| OAuth refresh token | 365 days, rotated on use, revoked on credential revocation |
| Authorization code | 10 minutes, single use, PKCE S256 required |
| Client registration | Dynamic, public clients only, https redirect URIs (localhost http allowed) |
| Protocol versions | 2025-06-18, 2025-03-26, 2024-11-05 |
Sandboxes
Sandboxes are synthetic, isolated companies for evaluation. They must never hold real records. They are soft-deleted at expiry with no recovery.
| Item | Value |
|---|---|
| Lifetime | 7 days |
| Per address | 3 per hour, 8 per day |
| Active sandboxes service-wide | 500 |
| Seed data | Starter chart of accounts, 15 invented entries over two months |
| Browser sign-in | Included, deleted with the sandbox |
Service posture during early access
Pricing is USD 0 for all plans during early access. There is no uptime commitment, no support commitment and no production certification. Data is retained under the privacy policy and can be exported. The API host, the database and the static site are separate services, so the marketing pages and the machine-readable catalog remain available when the API is not.