Update a spend limit
Changes the amount, the ceiling, what counts, the action, the alert thresholds or whether the limit is enabled. A field you leave out keeps its value. The scope and the period can’t change: create a new limit. In live mode the same rules apply as for creating one: a limit that isn’t for one customer is configuration and is refused with 403 and proposal_required. An agent key may tighten a customer’s limit and loosen none of it: a higher amount or ceiling, counts narrowed from all_usage to paid_usage, action from block to warn, an alert_at threshold raised or dropped, or enabled: false is refused with 403 and permission_denied.
Authentication
A secret key (rl_sk_test_..., rl_sk_live_...) or a restricted key with limited scopes (rl_rk_test_..., rl_rk_live_...). A restricted key can carry agent: true and an expires_at, and is what a coding agent should hold. Keys end in a checksum so secret scanners can recognize them. People create, roll and revoke keys in the dashboard; GET /v1/api_keys lists them, masked.
Path parameters
The spend limit ID (sl_...).
Headers
Send true to see what the write would do without doing it. The response is the normal body with dry_run: true, changes (path, before, after), warnings and errors added, and nothing is stored. Validation runs as it would for a real write. The request is kept in request logs, tagged Dry run. When the same change is then made for real, its audit event has dry_run_preceded: true.
Request
The most a customer may set for themselves. A customer-set limit above the ceiling of the limit it replaces is parameter_invalid.
What counts toward the limit. paid_usage: the money value of consumption drawn from paid credits and overage, so included and promotional usage keeps working. all_usage: the money value of everything. Buying credits never counts.
warn adds warnings and a webhook. block also denies in check().
Decimals from 0 to 1. spend_limit.threshold_reached is sent once per period for each.
Response
Every condition you send must match, and a limit with none applies to the whole account. Limits are grouped by which of agent_id, member_id, team_id and pool they name. Inside a group the most specific one applies to a customer: its own customer, then its plan, then the account. Every group that applies must have room, so the strictest group decides.
What counts toward the limit. paid_usage: the money value of consumption drawn from paid credits and overage, so included and promotional usage keeps working. all_usage: the money value of everything. Buying credits never counts.
warn adds warnings and a webhook. block also denies in check().
operator: you set it as policy. customer: your customer chose it, through your product or the customer view.
What has been spent against the limit this period. Read-only.