{"perRequest":{"maxBodyBytes":5242880},"perBoard":{"maxTexts":500,"maxTextContentChars":100000,"maxImages":50,"maxImageBytesTotal":10485760,"maxImageBytesPerItem":900000,"maxStrokes":2000,"maxColumns":200,"maxColumnsPerLane":20,"maxLanes":10,"maxTasks":1000,"maxTaskContentChars":20000},"boardImport":{"maxItems":2550,"maxBatchStatements":320,"countedCollections":["texts","lines","images","columns","tasks","lanes"],"counting":"Sum of input array entries across the counted collections, exactly as supplied — entries are never merged, and a lane named twice is rejected rather than collapsed. `strokes` is an alias for `lines`, not an additional collection. Template-seeded columns are not counted as input items.","maxLaneTitles":10,"laneTitleRule":"Each lane title must reference a lane used by a column created in the same request (content columns or template columns).","infrastructureToken":"X-Import-Token is a server-to-server credential. A valid token selects the infrastructure REST/MCP and board-create rate tiers; it does not bypass import, validation, per-item, per-board, request-body, board-access-lock, security, or Cloudflare platform limits."},"fieldLimits":{"maxAuthorChars":80,"maxThumbnailBytes":8000,"textWidth":{"min":160,"max":4096},"columnWidth":{"min":200,"max":480,"default":280},"maxLaneTitleChars":200,"maxColumnTitleChars":200,"maxTaskNameChars":500,"maxAssigneeChars":200},"operationLimits":{"maxRecolorItems":500,"maxBatchOps":500,"wsContinuation":{"maxFrames":500,"idleMs":500}},"rateLimits":{"standard":{"restMcpPerBoard":{"requests":60,"windowSeconds":10,"per":"board","enforcement":"Worker-isolate-local soft ceiling"},"boardCreate":{"requests":5,"windowSeconds":60,"per":"clientIp","enforcement":"Cloudflare Rate Limiting binding; permissive and eventually consistent per edge location"}},"infrastructure":{"credential":"valid X-Import-Token (server-to-server only)","restMcpPerBoard":{"requests":600,"windowSeconds":10,"per":"board","enforcement":"Worker-isolate-local soft ceiling"},"boardCreate":{"requests":50,"windowSeconds":60,"per":"infrastructureToken","perNote":"Keyed by a one-way digest of the token VALUE (the credential never enters limiter keys or telemetry). There is a single import-token secret, so all trusted callers share this one bucket — it is not a per-integration allowance.","enforcement":"Cloudflare Rate Limiting binding; permissive and eventually consistent per edge location"}},"webSocket":{"requests":60,"windowSeconds":10,"per":"board","enforcement":"BoardServer Durable Object, strong","infrastructureTokenChangesTier":false},"security":{"lockUnlockVerify":{"requests":5,"windowSeconds":60,"per":"clientIp","infrastructureTokenChangesTier":false}},"tokenPolicy":"X-Import-Token raises only REST/MCP and board-create rate tiers. It never bypasses hard caps or board access locks.","onExceeded":{"rest":"HTTP 429 + Retry-After","mcp":"-32000 code:rate_limited","ws":"{type:\"error\", code:\"rate_limited\"} frame"}}}