Plan limits and licenses
Embed
<a href="https://forumulate.com/p/watchtower/docs/limits"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/65910a7d-8299-49ee-9348-210fc8511d6c/social-card.svg?v=3e7ae33eec8b" alt="Plan limits and licenses" width="600" height="315"></a>Nothing is limited unless a signed license (or an entitlements row) says so. A self-hosted install with no license has every quota unlimited and a 30 s floor on check intervals that is not enforced (advisory-off). The license check is offline: Ed25519 signature, validity window and org binding, with no network call.
License file
POST /v1/orgs/{org}/license (needs ManageSecurity) takes {"license": {id, org_id | "*", plan, limits, valid_from, valid_to, key_id}, "signature": "<base64url>"}. Times are unix seconds. The signature covers the compact JSON of license with the fields in exactly that order. org_id is the org's public id (org_...) or *. Trusted keys are compiled in (LICENSE_KEYS, empty until the vendor key exists) plus WT_LICENSE_PUBKEYS=id:base64url,... for self-signed enterprise installs. An expired license falls back to the default. GET /v1/orgs/{org}/entitlements shows usage versus limits.
Limits
Exceeding one answers 422 limit_reached with metric, limit and current.
Metric | Meaning |
|
|---|---|---|
| people with a shift that has not ended | 5 |
| paths summed over all policies | 3 |
| monitors | 10 |
| fastest check interval | 300 |
| probe runs per calendar month | 10000 |
| enrolled agents | 5 |
| enrolled agents | 5 |
| private probe locations | 1 |
null / absent means unlimited.
Check run cost model
One run is one probe execution from one location. Browser and k6 runs count 10.