This page gathers the limits stated across the documentation, each with a link to the page that explains it. Plan values are the catalogue values of the IoT add-on; your organisation’s own values (an Enterprise agreement, a usage pack) are shown on Usage and in the limit messages, and always win. Fixed limits are the same for everyone. Where a limit has a default that you can change, the range is given.
Plan limits by IoT tier
Limit Starter Growth Scale Plan key Page Devices 43 77 403 max_devicesPlans and the IoT add-on IoT messages per month (soft) 1,150,000 4,260,000 28,810,000 max_iot_messages_monthlyMessage quota and usage Telemetry keys 250 400 2,050 iot_max_telemetry_keysTelemetry keys Telemetry retention 365 days 365 days 365 days iot_telemetry_retention_daysHow long data is kept Flows 6 12 58 max_flowsFlow limits Script blocks in deployed flows 3 6 29 max_script_blocksFlow limits Messages per second, whole organisation 10 15 70 iot_max_msgs_per_secondPlans and the IoT add-on Data points per minute, whole organisation 6,000 9,000 42,000 iot_max_datapoints_per_minutePlans and the IoT add-on
The same in every tier:
The platform plan can also limit members, open invitations, custom domains, API keys, shared dashboards, e-mails and SMS per month, automation messages and storage. A limit your plan does not state is not a limit. See Plans and the IoT add-on .
What happens at a plan limit
Limit At the limit Devices New devices are refused (403, details.key max_devices); existing devices keep working IoT messages per month Nothing stops: messages are accepted and the overage is billed Telemetry keys A new key is not stored (key_limit); the other keys of the record are Flows, script blocks New flows and deployments are refused Messages per second, data points per minute Messages over the rate are acknowledged and dropped; HTTP answers 429 with Retry-After; owners and admins get one notice per hour Automation messages (General host, only when the plan sets a quota) New entries are refused until next month; webhook calls answer 429 Cameras with live view Turning live view on is refused Camera minutes Viewers see Camera minutes used up until the month changes Panel data New panel sessions are refused; running ones are not cut E-mails, SMS That channel is left out; the others still go out
Quota warnings
When What happens Page A threshold is passed: 80 % and 95 % by default (1 to 5 values, each 1 to 99 %) usage.threshold webhook; owners and admins are toldUsage and quotas The quota is used up exactly Owners and admins are told same The count goes over usage.overage webhook; owners and admins are toldsame
Devices and profiles
Limit Value Page Profile name 1 to 128 characters, unique Device profiles Profile description 2,000 characters same Telemetry keys listed on a profile 500 Telemetry keys Rate-limit windows per family At most 4; count 1 to 1,000,000 over 1 second to 1 day Device profiles Allowed networks 64 networks or addresses Device transport security Commands allowed without TLS 32 same Children per gateway 500 by default (profile 0 to 10,000; plan 500 when it names none; platform ceiling 1,000) Devices behind a gateway Children in one gateway message 500; records per child 1,000; meta per record 256 bytes same Device import 1,000 rows per file; 50 attribute columns; values 4,096 characters Importing devices in bulk Quarantine activation 100 devices at a time Quarantine Serial Up to 32 characters (licensed devices: 6 to 32) Importing devices in bulk , Device identity and claiming security
Per-device rate limits (profile defaults)
Family Default Over the limit Telemetry messages 10:1,300:60 (10 a second, 300 a minute)Acknowledged and dropped Telemetry points 200:1,6000:60Acknowledged and dropped Attribute updates 5:1,60:60Acknowledged and dropped Attribute requests, RPC messages 5:1,60:60Certificate requests 1:3600Connects 6:60Replay messages per second Half the per-second telemetry count (1 to 10,000)
A device that drops more than three times its minute allowance within a minute has its session closed. See Device profiles .
Credentials and certificates
Limit Value Page Access token 32 characters, generated Device credentials MQTT username 1 to 128 printable characters, unique on the platform; provision reserved same MQTT client ID 1 to 64 characters A–Z a–z 0–9 . _ : - same Chosen MQTT password At least 16 characters (an organisation may require up to 128), at least 8 different characters same Device certificate lifetime 365 days by default (30 to 825) The device certificate authority Certificate expiry warning 30 days by default (30 to 180) same
MQTT and the device HTTP API
Limit Value Page Protocol MQTT 3.1.1 MQTT Message size 64 KiB by default (1,024 to 65,536 bytes), at most 1,000 key-value points same Messages to the device 64 KiB by default (4 KiB for licensed devices) same Unacknowledged QoS 1 messages 20 by default (1 to 1,000) same Keepalive Above 300 s (or 0) is served as 300 s on a default installation same Sessions per device 1; a second connection takes over same Raw payload (raw key) 4,096 bytes by default (256 to 65,536) Telemetry keys HTTP command poll One open poll per device Device HTTP API
Telemetry and data
Retention
Retention class Raw readings Minute aggregates Hour and day aggregates 7 days 7 days 7 days 7 days 30 days 7 days 30 days 30 days 90 days 30 days 31 days 90 days 365 days 90 days 31 days 365 days 1,095 days 90 days 31 days 1,095 days
A reading older than the raw window is refused (too_old). See How long data is kept .
Reading data
Attributes
Limit Value Page Key 1 to 128 characters A–Z a–z 0–9 _ . - Attributes Shared key (other than cfg.*) 57 characters same Server or client value 64 KiB same Shared value The device’s downlink limit same Nesting 8 levels same Keys per API read or write 100 same
Commands, firmware and settings
Limit Value Page Commands per device 10 a minute Sending commands to devices Commands per organisation 600 a minute same Parameters 16 KiB of JSON; 50 parameters per command same Answer kept 64 KiB same Answer timeout 1 to 600 seconds (10 by default) same Give up after (persistent) 24 hours by default, at most 7 days same Synchronous API call Waits at most 30 seconds Commands API Commands per profile catalog 200 same Command history 90 days Sending commands to devices Firmware download time 60 minutes by default (5 to 1,440) Firmware updates (OTA) Firmware install time 20 minutes by default (2 to 240) same Tries per update 3 by default (1 to 10) same fw_url validity15 minutes same Rollout waves 20; soak time 0 to 10,080 minutes Rolling out firmware in waves Pending setting changes Withdrawn after 7 days Remote device settings Settings history 50 changes per device and section, up to 365 days same Settings writes 600 a minute per organisation same
Alarms
Limit Value Page Rules per profile 50 Alarm rules on device profiles Comparisons per condition 16; all/any nesting 4 levels same Type 128 characters same Title, runbook 300 and 10,000 characters same Debounce 1 to 86,400 readings or seconds same Recipients 20 same Offline delay 10 s to 7 days same Reminders (repeatEverySec) 60 s to 7 days Alarm notifications in depth Repeat window 300 s by default (60 to 86,400) same Storm threshold 20 a minute by default; critical alarms during a storm 60 a minute same Notes 2,000 characters Working with alarms Mute At most 90 days; reason 500 characters Muting a device for maintenance Resolved alarms kept 365 days by default Alarms
Rules card
Limit Value Page Triggers per rule 10 Rules card: triggers Conditions per group 16; nesting 4 levels The rules engine Actions per rule 20 same Choice branches 5; nesting 2 levels same Devices one row acts on 200 same Devices in a home’s scope 2,000 same Longest wait 24 hours same Every so often 1 to 1,440 minutes Rules card: triggers Run history 30 runs The rules engine Notify 20 recipients; message 1,000 characters same
Flows
Limit Value Page Blocks in one flow 500 Flow limits Message size 256 KiB same Steps in one run 512 same Runs of one flow a minute before it pauses 6,000 by default same Script CPU per message 50 ms by default (a plan can raise it to 200 ms); memory 32 MiB; code 64 KiB The script block Longest wait 7 days Flow limits Flow context, global context 1 MiB per flow, 4 MiB per organisation same Webhook calls 60 a minute per webhook; 50 per 5 seconds per organisation same HTTP request 10 s timeout by default (1 to 30); answer 64 KiB by default (at most 256 KiB) same Notify 20 recipients; 10 attachments, 1 MiB together; title 200 and text 4,000 characters Notifications from rules and flows Same notification to the same person Once per 10 minutes by default same Commands from flows to one device 30 a minute by default Flow limits Run records, debug messages, logs 24 hours same Deleted flows Restorable for 7 days same
LoRaWAN
Limit Value Page Region EU868 only Regions and frequency plans Versions, classes 1.0.2, 1.0.3, 1.0.4; Class A and C LoRaWAN limits Downlink data 1,024 characters; FPort 1 to 223; 51, 115 or 222 bytes by data rate same Decoded keys per message 64, nested at most 4 levels same Pairing window 1 to 120 minutes; 200 devices listed Pairing mode Frames log The last day, 1,000 frames per organisation The frames log Your codec 40,960 bytes; 1 to 200 test vectors Write your own codec Gateway map 1,000 gateways LoRaWAN limits
Edge, polling and remote access
Limit Value Page Poll interval 5 minutes by default; between 30 s and 1 day Polling intervals, back-off and quota Back-off after failures Doubled each time, at most 1 hour same Offline after 3 failed polls in a row same SNMP mapping 200 telemetry keys per device same Panel sessions per router 3 Remote access limits and audit Panel session 30 minutes idle; 4 hours at most; 50 MB on a mobile uplink same Ended sessions listed 180 days same
Cameras
Limit Value Page Codecs H.264 only, no audio Camera limits and privacy Channels in one add 64 same Live link requests 24 a minute per person and camera same Stream link Valid 10 minutes, renewed by the player same Still watching? Every 5 minutes; 30 seconds to answer same Remote sites camera page 4 cameras per site Remote sites: UPS and cameras
Dashboards, SCADA and sites
Limit Value Page Pages per board Main page and up to 20 more Create and organise boards Parameters 16 value parameters, 48 in all; 16 in the filter bar Data sources and parameters Entities in a resolved parameter 500; a fixed list 100 same Key filters 16 filters per board, 8 key filters each, 4 conditions each same Longest window 366 days; 500 intervals same Table rows At most 500 per source Tables and lists Compute script 65,536 characters; 10 to 500 ms (50 by default); 5,000 rows; 2 MiB Compute scripts Display link 1 to 365 days Sharing dashboards Process drawings 500 per organisation; 2 MiB, 200 symbols, 300 connections each SCADA 3D designs 200 per organisation The 3D designer Asset code 32 characters, unique Asset hierarchy Assets in one tree read 5,000 same Devices placed at once 100 same Relation extra information 20 keys, 4 KiB Relations Status table 200 rows over 5,000 devices Site views
Notifications
Limit Value Page Bell The newest 50 items per person, kept 7 days by default (1 to 365) The bell Push devices per member 10 by default (1 to 100) Browser push SMS to one number Further messages within 60 seconds are dropped SMS Mail attachments 10 files and 7 MiB per mail Email
API, webhooks and AI assistants
Limit Value Page Calls per IP address 120 a minute Errors and rate limits Calls per API key 1,000 a minute by default (Per-Key Rate Limit ) same API key lifetime 90 days by default, at most 365 days API key hardening Webhook custom headers, tags 20 each Webhooks Webhook rate limit 1 to 100,000 a minute per endpoint (unlimited by default) same Device events to webhooks 600 of each kind a minute per organisation same Old signing secret Valid 48 hours after rotation same MCP tool calls 120 read and 20 write a minute per credential MCP settings and safety MCP history read 31 days, 10 keys, 500 points per key same Codec API 60 a minute without credentials; 240 a minute signed in Codecs API Audit log page size 100 by default, at most 500 Audit log
People and sign-in
