Quotas & plan limits

Every organization runs on a plan (tier) that grants a set of quotas. Quotas are per organization, not per user: creating a company org starts a new Free meter and does not share leftover capacity from your personal workspace. Every new org starts on Free until an admin pays for an upgrade. The Billing page in the dashboard shows your current usage against each limit, lets admins switch plans, and warns you as you approach a cap.

Billing page with current plan and quota usage meters.(click to enlarge)

Close

How quotas work

Quotas fall into two shapes:

• Capacity quotas (unit: count, period: lifetime) cap how many of a resource can exist at once — devices, entities, zones, integrations, API keys, child organizations, and org members. These are checked before creation. When you are at the cap, the create request fails with 429 quota_exceeded; delete something or upgrade to make room.
• Metered quotas (period: per day, per month, or per session) count actions over a rolling window — door opens, AI requests, video sessions, and so on. When the window’s limit is reached, further actions are rejected until the window rolls over (or you upgrade).

Each quota carries a machine-readable unit so clients can format it correctly:

• count — a plain tally (door opens, devices, …).
• seconds — a duration (video session length), shown as minutes/hours in the UI.

Quota reference

Quota key	Consumed by	Unit	Period
entities	Creating an entity	count	lifetime (capacity)
devices	Creating a device	count	lifetime (capacity)
zones	Creating a zone	count	lifetime (capacity)
integrations	Creating an integration (and inbound transfers)	count	lifetime (capacity)
api_keys	Minting an API key (incl. voice keys)	count	lifetime (capacity)
org_users	Adding a user to the org / accepting an invite	count	lifetime (capacity)
organizations	Creating a child organization under this org	count	lifetime (capacity)
door_opens	Opening a door (switchable.open, portals, sessions, invites)	count	per day and per month
voice_invocations	Opening a door via a voice/API key	count	per day
portal_views	Fetching a public portal’s config	count	per day
scripting_executions	Running a scripting program	count	per day
geocoding_requests	Creating/updating a location that is geocoded	count	per day and per month
ai_requests	AI translation and apartment enrichment	count	per day and per month
video_sessions	Starting a video session	count	per month
video_session_duration_seconds	Video call airtime	seconds	per session

Free is sized for one first Access site on that org: two integrations (Virtual Access plus a device provider), four devices (directory, opener, optional demo light, portal), and a handful of entities. Catalog Free allows zero child organizations; a personal workspace gets an override of one so you can create a single company org. Nested orgs under that company require a paid plan on the company org. Sibling company orgs require upgrading the workspace.

Approaching and exceeding limits

• Warnings. A banner appears in the dashboard once any quota crosses a high-usage threshold, and the Billing page color-codes each meter. The banner is dismissable per organization and reappears if usage gets worse.

Billing over-capacity warning banner.(click to enlarge)

Close

• At the cap. Capacity creates return 429 quota_exceeded; metered actions are rejected until the window resets. In the dashboard, that warning includes an Upgrade plan control that opens the Billing page.
• Changing plans. Admins (members with billing:manage) can switch tiers from the Billing page. A downgrade is allowed even when current usage exceeds the new tier’s caps — existing resources keep working, but new creates are blocked until you are back under the cap, and the Billing page marks which quotas are over the lower tier.

Over-capacity remediation

If an organization downgrades (or otherwise ends up over its plan limits), OpenApp does not delete your data abruptly. Instead it applies a gradual, reversible lifecycle:

1. Warned — the org is flagged as over capacity; admins are nudged to act.
2. Degraded — excess resources introduce friction. Opening a flagged (excess) door is intentionally slowed (never blocked); a readable notice explains why and points you to your admin. Non-admin members are also blocked from creating new resources or invites while the org is over capacity. Admins stay exempt so they can remediate.
3. Marked for deletion — after further grace time, excess resources are marked, and the friction escalates to more users.
4. Soft delete — only after all grace periods elapse are excess resources soft-deleted (recoverable for a retention window). Org members are never removed, and no one is locked out of their doors.

The friction level is a continuous value (0–1) that scales the door-open delay, so the experience worsens gradually rather than flipping a switch. Admins can choose which excess resources are wound down first via a selection policy (newest-first, oldest-first, least-recently-used, or manual) and can pin specific resources to keep. All of this is visible on the Billing page’s remediation panel.

To resolve degradation, upgrade the plan or free up capacity (delete or pin resources) until usage is back within the tier’s limits; the lifecycle then heals automatically.