> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Discover operating limits

> Discover upload sizes, supported file types, request budgets, polling intervals and resource expiry through your environment configuration.

Read configuration.operational\_profile to discover the effective limits for your workspace and environment. The response includes a profile ID and version, supported file types, request budgets and resource lifetimes. Use these values when configuring uploads, polling and recovery.

| Setting | Behavior |
| - | - |
| max\_json\_bytes | Reject larger JSON bodies with 413 before command acceptance |
| max\_upload\_bytes / max\_document\_pages | Reject oversized uploads with 413; inspection rejects over-limit pages without treating the file as available |
| allowed\_document\_mime\_types / document\_types | Validate detected content and declared type; do not trust a filename extension |
| session\_ttl\_seconds / download\_ttl\_seconds | Use the actual expires\_at returned for each issued capability |
| snapshot\_ttl\_seconds | Stable collection and billing snapshot lifetime; expose expires\_at or snapshot\_expires\_at |
| data\_feed\_retention\_seconds / event\_retention\_seconds | Recover before the returned resume\_expires\_at; expired cursors return 410 |
| export\_retention\_seconds | Download a ready export before its retention expiry; do not assume URLs last as long as export metadata |
| poll\_min\_interval\_seconds / poll\_max\_interval\_seconds | Poll no faster than the minimum; back off with jitter up to the maximum |
| webhook\_timeout\_seconds / webhook\_max\_body\_bytes | Receiver must durably accept and respond inside the deadline; oversized event production is forbidden |
| webhook\_rotation\_overlap\_seconds | Old and new secrets verify during this overlap; rotate before disabling the previous secret |
| rate\_limits | Rolling request budget shared across keys in the workspace/environment for reads, commands and uploads |

GETs use the reads budget, uploadDocument uses uploads, and other POST/PATCH requests use commands. A 429 carries Retry-After in whole seconds, which overrides local polling schedules. A 503 may include it as well. Caller timeouts do not cancel accepted work. Keep total waiting bounded in your application and hand unresolved requests to durable background reconciliation.

The [example profile](https://docs.amlok.io/downloads/development-profile.json) provides synthetic values for local tests. Use the profile returned by your environment for its effective limits. Source freshness and coverage remain provider-specific; polling frequency does not make sources refresh faster.

## Changes and expiration

Profiles apply prospectively. Existing issued capabilities and cursors keep their disclosed expiry unless authorization is revoked or the workspace closes. Save the profile ID/version with integration diagnostics. Key revocation and consent withdrawal take priority over unexpired links or retained snapshots.

Snapshots bind workspace, environment, caller authorization and filters. Cursor chains cannot change filters. Empty change/event batches still return a resumable cursor and expiry. On 410, establish a new checkpoint and reconcile a fresh complete snapshot, including deletions; never silently discard the gap.

## Upload inspection

The example profile accepts PDF, PNG, JPEG and WebP. Check allowed\_document\_mime\_types for the types supported by your environment. Password-protected/encrypted files and archives are not accepted by this contract. Detected type mismatch returns 415 unsupported\_media\_type. If discovered after asynchronous acceptance, the document becomes rejected with failure.code document\_rejected and a safe explanation. Infected, corrupt, empty or unreadable files never become available. Re-upload a corrected file as a new immutable record.

Client-side checks improve feedback; AMLOK validates size, content type and authorization for every upload. Uploads are not fetched from arbitrary customer URLs. Downloads use short-lived HTTPS capabilities with MIME type and SHA-256; verify integrity after transfer and avoid logging URLs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.