OpenStack API limits
Find the fixed limits of application credentials, such as how many you can have and how long they last, and the quotas that API resources use.
OpenStack API Access has two kinds of limits:
- Quotas. The subscription's quota and the project's allocation cap how many resources a project can use. Resources that you create through the OpenStack APIs count against them like resources that you create in the console.
- Product limits are fixed rules for application credentials. They can't be changed.
Quotas
The OpenStack services enforce each project's share of your subscription's quotas, the project's allocation. A request through the APIs that would go over it is refused, as a create in the console is. To see or raise them, see Quotas.
Product limits
| Resource | Limit | Adjustable? | Notes |
|---|---|---|---|
| Projects per credential | 1 | No | A credential is bound to the project where you created it. |
| Active credentials per owner | 20 | No | An owner is a member or a service account. |
| Active credentials per project | 50 | No | Credentials that are being created count too. |
| Credential lifetime | 1–365 days | No | The default is 90 days. The console offers 7, 30, 90, 180, and 365 days. |
| Expiry notices | 14 and 3 days before expiry | No | Sent when 14 days or fewer are left, and again when 3 days or fewer are left. By email to the owner, or for a service account to the member who created the credential. |
| Rotation overlap | 0–168 hours | No | The default is 24 hours. The console offers 0, 1, 24, 72, and 168 hours. |
| Credential name | 1–63 characters | No | Letters, digits, spaces, ., _, and -, starting with a letter or a digit. It can't end with a space, and it can't start with pc_live_ or sak_live_. |
| Credentials created at once per owner | 1 | No | A second create for the same owner waits; if the first takes too long, the second is refused, and you try again. |
| Revoked and expired credentials in the list | 90 days | No | Then they're removed from the list. |
Identity & AccessOpenStack API access shows how many credentials are active in the project under Limits. To free up a slot, revoke a credential that you no longer use. See Rotate and revoke credentials.