Limits

Quotas cap how much your organization can hold at once, such as instances, vCPUs or volume storage. They protect you from runaway automation and the platform from overload. This page lists every quota, how to read it, and the hard limits that apply regardless of quota.

How quotas work

Quotas apply at two levels, and both are checked on every request that consumes one:

Organization quota
The limit for the whole organization. Origin Cloud sets it, and it can differ between organizations. To raise it, contact Origin Cloud support.

Project budget
An optional limit you set on a single project, so one project can’t use up the whole organization’s allowance. A project has no budget until you set one; it’s then bounded only by the organization quota. A budget can’t exceed the organization quota for the same dimension, and the budgets of several projects may add up to more than the organization quota: they’re limits, not reservations.

Quotas count what exists now, not what you created over time. Deleting a resource frees its share of the quota at once.

Read your quota

The organisationQuota query returns each limit together with current usage, counted at the moment you ask. Anyone with read access to the organization can read it.

query {
  admin {
    organisationQuota(orgId: "<org-id>") {
      maxInstances      currentInstances
      maxVcpu           currentVcpu
      maxVolumeGib      currentVolumeGib
      maxVpcs           currentVpcs
      maxPublicIps      currentPublicIps
    }
  }
}

projectQuota(orgId: "<org-id>", projectId: "<project-id>") returns the same fields for one project. There, a max* field is null when the project has no budget for that dimension. The CLI doesn’t show quotas.

Set a project budget

Set one dimension of a project’s budget with the setProjectQuotaLimit mutation, and remove it with clearProjectQuotaLimit. Both need the admin.resource_quota.update permission, which the Owner role has.

mutation {
  admin {
    setProjectQuotaLimit(input: {
      orgId: "<org-id>"
      projectId: "<project-id>"
      dimension: MAX_VCPU
      value: 16
    }) {
      maxVcpu
      currentVcpu
    }
  }
}

dimension is one of MAX_INSTANCES, MAX_VCPU, MAX_VOLUME_GIB, MAX_VPCS and MAX_PUBLIC_IPS. A negative value, or one above the organization quota, is refused rather than capped. Lowering a budget below current usage doesn’t remove anything; it refuses further growth until usage drops below the budget.

What a refusal looks like

A request that would exceed a quota fails with BAD_REQUEST on the field quota, and nothing is created. The message names the scope, the dimension, the current usage and the limit:

invalid input on field quota: project quota exceeded: vCPU usage is 14, requesting 4 more would exceed the limit of 16

Free up usage, raise or clear the project budget, or ask Origin Cloud support for a higher organization quota.

Compute

Quota	Field	Counts	Checked when you
Instances	`maxInstances`	Instances that aren’t terminated	Launch an instance
vCPU	`maxVcpu`	vCPUs of the instances that count, by instance type	Launch an instance, or change an instance to a larger type

Stopped instances count against both quotas until you terminate them. Changing an instance to a smaller type is never refused by quota. A launch also counts the instance’s root volume against the storage quota and, in a subnet that assigns public IPs, its public address against the public IP quota.

For instance type sizes and the root disk size rules, see Instance types and Launch an instance.

Storage

Quota	Field	Counts	Checked when you
Volume storage	`maxVolumeGib`	The size in GiB of all volumes that aren’t deleted	Create or import a volume, grow a volume, or launch an instance
Snapshots	Not readable	Snapshots	Create a snapshot

A resize counts only the growth, not the volume’s whole new size.

The snapshot quota applies per organization. It isn’t returned by organisationQuota; the refusal message states the limit.

For volume sizes, see Volumes.

Network

Quota	Field	Counts	Checked when you
VPCs	`maxVpcs`	VPCs, including default VPCs	Create a VPC, or launch the first instance into a project’s default VPC
Public IPs	`maxPublicIps`	Floating IPs, whether you allocated them or the platform assigned them at launch	Allocate a Floating IP, or launch into a subnet that assigns public IPs
Subnets	Not readable	Subnets	Create a subnet
Internet gateways	Not readable	Internet gateways	Attach an internet gateway
NAT gateways	Not readable	NAT gateways	Create a NAT gateway
Route tables	Not readable	Route tables	Create a route table
Network ACLs	Not readable	Network ACLs	Create a network ACL
Security groups	Not readable	Security groups	Create a security group
Rules per network ACL	Not readable	Rules in one network ACL	Replace a network ACL’s rules
Rules per security group	Not readable	Ingress and egress rules of one security group, combined	Replace a security group’s rules

The quotas marked “Not readable” apply per organization and aren’t returned by organisationQuota; the refusal message states the limit. The two rule quotas apply to each network ACL or security group separately.

If the platform assigns no public address at launch, for example because the public IP quota is used up, the launch still succeeds and the instance runs without one. See Default VPC.

For address ranges and subnet sizes, see VPC and subnet addressing.

IAM

IAM has no quotas. The number of members, role assignments and service accounts in an organization isn’t limited.

Limit	Value
Audit log entries per page	100 by default, 500 at most. See Audit log.
Org-wide Owners	At least one at all times. The last one can’t be revoked or removed.

Organizations and projects

Limit	Value
Projects per organization	No quota
Project ID	At most 16 characters, including the prefix you choose
Support cases per page	100 by default, 500 at most