PolyAccounts · Service
Limits, quotas and service levels
What an agent or an integrator can rely on: request sizes, timeouts, pagination, credential lifetimes, sandbox quotas, read metering (none) and service availability.
Requests and reads
Agent reads are not metered and are not billed. Fair-use limits exist to protect the shared service and are listed here so an agent can plan around them rather than discover them.
| Limit | Value |
|---|---|
| Agent request body | 256 KB |
| Read transaction statement timeout | 15 seconds, repeatable-read, read-only, UTC |
| ledger_entries pagination | Keyset cursors bound to company and filters. follow next_cursor |
| Remote MCP tools/call timeout | 90 seconds |
| Read metering | None |
Credentials and OAuth
Every access path issues the same company-scoped agent credential. Credentials are bound to the issuing administrator and are denied when that administrator is removed, suspended, changes company, loses the role or resets their password.
| Item | Value |
|---|---|
| Credential expiry from Settings | 1 to 365 days, default 90 |
| OAuth access token | A 90-day agent credential |
| OAuth refresh token | 365 days, rotated on use, revoked on credential revocation |
| Authorization code | 10 minutes, single use, PKCE S256 required |
| Client registration | Dynamic, public clients only, https redirect URIs (localhost http allowed) |
| Protocol versions | 2025-06-18, 2025-03-26, 2024-11-05 |
Sandboxes
Sandboxes are synthetic, isolated companies for evaluation. They must never hold real records. They are soft-deleted at expiry with no recovery.
| Item | Value |
|---|---|
| Lifetime | 7 days |
| Per address | 3 per hour, 8 per day |
| Active sandboxes service-wide | 500 |
| Seed data | Starter chart of accounts, 15 invented entries over two months |
| Browser sign-in | Included, deleted with the sandbox |
Service and data access
All plans are free through December 31, 2026. From January 1, 2027, Solo is USD 29, Professional USD 79 and Firm USD 199 per month. Agent access is included. Data is retained under the privacy policy and can be exported. The API host, the database and the static site are separate services, so the marketing pages and the machine-readable catalog remain available when the API is not.