Defaults and Limits

Ports

Component	Port
API	3000
Web console	3001
STS	8080
Gateway	8081
Audit	9090
Coordinator	4000
Postgres	5432
Redis	6379

Token and Authority Lifetimes

Limit	Default
STS resource mandate cap	15 minutes
STS session mandate cap	60 minutes
STS MAX_GRANT_TTL_SECONDS	3600
DCR application lifetime default and maximum	3600 seconds
caracal run injected credential TTL	900 seconds
Runtime approval wait	until the hold expires; 5-minute fallback when expiry is unavailable
Approval TTL	1800 seconds default, clamped between 60 seconds and 7 days
Approval decision reason	500 characters maximum
Gateway expiring-token preflight window	35 seconds

Service Limits

Limit	Default
API body limit	1_048_576 bytes
API request timeout	30_000 ms
Coordinator body limit	256 KiB
Coordinator request timeout	30 seconds
STS request body limit	64 KiB
Gateway max request bytes	10 MiB
Gateway STS timeout	5 seconds
Gateway upstream timeout	30 seconds
Gateway non-stream write timeout	60 seconds
Gateway stream idle timeout	60 seconds per chunk
Gateway server idle timeout	120 seconds
Gateway STS circuit failure limit	3 failures
Gateway STS circuit open window	10 seconds
STS OPA_POLL_SECONDS	60 seconds, max 300
Control body limit	64 KiB
Control rate capacity	60 per window
Control rate window	60 seconds
Control replay TTL	3600 seconds

SDK Timeouts and Retries

The SDKs share one timeout philosophy: control-plane calls are bounded, data-plane calls are bounded by you. Coordinator and STS operations carry defaults because a hung control plane must not hang the worker. Provider traffic through transport() carries no TypeScript/Go default because only the caller knows whether a request is a short lookup or a long stream; pass the language-specific timeout or cancellation primitive.

Operation	Default	Notes
Coordinator call	10 seconds	Per request, all SDKs.
Session start	up to 2 retries	5xx/network only. The SDK generates one operation id before the first attempt; Coordinator durably replays the same creation response and rejects changed inputs. This protects Session creation, not callback execution or downstream effects.
Delegation create	1 retry	Same durable creation-replay contract.
Coordinator retry backoff	250 ms escalating, jittered	A server Retry-After wins, capped at 10 seconds.
STS token exchange	30-second budget, one attempt	Issuance is never retried automatically because a lost response can hide a successfully minted token. Callers reconcile or explicitly retry according to their operation contract.
TypeScript Control invoke	30-second total budget	Covers one token mint and one invoke. Neither request is auto-retried; an invoke timeout is outcome-ambiguous.
Approval wait	300-second default	Long-polls in chunks; pending on timeout means waiting again is safe.
Heartbeat renewal	10-second bound per tick	Failures retry on the next tick; a session reported gone stops the timer and fires onLeaseLost.
transport() / fetch()	none (TS/Go), httpx default (Python)	Bound per call: timeoutMs, AbortSignal, timeout=, or the injected HTTP client.

Session and Delegation Limits

Limit	Default
Concurrent Sessions per zone	50 (MAX_AGENTS_PER_ZONE)
Concurrent Sessions per application	200 (MAX_AGENTS_PER_APP)
Child Sessions per parent Session	10
Delegation depth	10
Session labels per Session	32
Session label length	64 characters
STS request rate per zone, resource, and acting application	1000 per minute (STS_MINT_RATE_LIMIT_PER_MIN)

The per-zone ceiling binds first: with defaults, no application can hold more than 50 concurrent Sessions because its zone caps out there. The higher per-application ceiling matters once MAX_AGENTS_PER_ZONE is raised.

STS_MINT_RATE_LIMIT_PER_MIN is the deployment ceiling for the mint rate. Operators can set a lower working limit from the web console under Settings → Preferences → Mint rate limit; the STS applies a change within 30 seconds, and the working limit can never exceed the ceiling.

max_hops defaults to 1 on a constrained Delegation when omitted. The server validates every child bound against its parent’s remaining hops.

Storage and Stream Defaults

Default	Value
Audit retention	365 days
Audit max deliveries before DLQ	8
Audit claim idle	30 seconds
Audit tamper rolling window	4 hours
Redis audit stream intended max length	1,000,000
Redis audit DLQ intended max length	100,000
Redis policy/revocation/key stream intended max length	10,000

Helm Defaults

Service	Replicas	Max HPA replicas
API	2	8
STS	2	8
Gateway	2	16
Audit	2	8
Coordinator	2	8
Control	disabled	2 when enabled

Next Step

Use CLI Exit Codes when automating top-level caracal runtime commands.