Public traffic
Public request rate limits are enforced at Cloudflare, the layer that fronts every Brimble URL. Cloudflare’s limits adapt to traffic patterns and the type of request (browser, API, bot), so there’s no single fixed “N requests per minute” we publish, what counts as abusive is judged in real time. What you can rely on:- A burst of normal traffic from a single user won’t get throttled.
- A clear flood from one IP (scraping, password spraying, simple DDoS) is blocked at the edge before it reaches your container.
- When a request is throttled, the client gets
429 Too Many Requestsfrom Cloudflare. Bodies and other limits are independent.
Over-size bodies get
413 Payload Too Large.
Internal traffic
Service-to-service calls inside Brimble’s network (your projects calling each other over*.service.brimble.internal, the dashboard talking to the API) don’t go through Cloudflare and aren’t subject to public rate limits. Your internal traffic doesn’t count against any limit.
Build minutes
A separate limit governs builders:
Once monthly build minutes are exhausted on a paid plan, overage bills at $0.002/minute and rolls into the next invoice. On the free plan, builds queue indefinitely until the cycle resets.
Webhook delivery
Brimble retries failed webhook deliveries with exponential backoff:
After 5 failed retries, the delivery is dropped. The webhook is not disabled; future events still try to deliver.
Each delivery has a 10-second timeout. Your endpoint must return a response within 10 seconds.
Sensitive operations
A few operations require step-up 2FA before running:- Delete a project.
- Delete a custom domain.
- Rotate a database password.
- Transfer a domain out of Brimble.
- Transfer team ownership.