Limitations

This page describes the limitations of the Re:port Flow Content Service API.

tip

These limitations apply to the production environment (api.re-port-flow.com).

📦 How large can a request be?

The request body may be up to 50MB after Base64 encoding, which works out to roughly 37MB of raw data. Anything larger comes back as a 413, so optimise your images or split the payload.

Maximum Request Size: 50MB

The maximum request body size is 50MB (after Base64 encoding).

Effective file size estimate:
- Before Base64 encoding: ~37MB
- Encoding overhead: ~1.33x

tip

As a PDF output SaaS, we provide sufficient capacity to handle PDFs with large amounts of high-resolution images.

Behavior on Exceeding Limit

When the request size exceeds 50MB, the API returns status 413.

The response body may not follow the error format documented in Error Handling (with code / details / docsUrl). Detect this case by the 413 status code.

Handling Large Files

For large images or data, consider the following approaches:

Optimize Images
- Reduce resolution (72-150dpi for web, 300dpi for print)
- Adjust compression (JPEG quality 80-85% recommended)
- Remove unnecessary metadata
Use Async Endpoints
- For generating many PDFs, use async endpoints
- Process large data without timeout concerns
Split Data
- Divide requests when generating multiple PDFs in a single request

⏱️ Timeout Limits

Sync Endpoints: 60 seconds

Affected Endpoints:

POST /v1/file/sync/single
POST /v1/file/sync/multiple

A sync request times out if no response arrives within 60 seconds. The load balancer (ALB) in front of the API closes a connection that has been silent for 60 seconds.

Timeout Response:

The API returns status 504. This response comes from the gateway in front of the API, so the body is not necessarily JSON and does not follow the error format documented in Error Handling (no code). Detect it by the status code.

Use async for anything that may take more than 60 seconds

A sync request sends nothing back until the PDF is ready, so if generation takes 60 seconds or more, the load balancer closes the connection and you get a 504. Generation may still continue on the server after the timeout and count against your output pages (see Error Handling). Use the async endpoints for anything that may take more than 60 seconds.

For processing exceeding 60 seconds:

Use async endpoints (/async/single, /async/multiple)
Reduce template complexity (fewer images, table rows)
Split requests

Async Endpoints: No Limit

Affected Endpoints:

POST /v1/file/async/single
POST /v1/file/async/multiple

Async endpoints have no timeout limit. They're suitable for bulk PDF generation and complex template processing.

🚦 Rate Limit

API requests are rate-limited per workspace, with a separate limit for each type of endpoint.

Workspace-based Limits

Rate limits are applied per workspace. Requests from the same workspace are counted together, without affecting other workspaces.

Endpoint Type	Limit	Target Endpoints
Sync Endpoints	30 requests/min	`/sync/single`, `/sync/multiple`
Async Endpoints	100 requests/min	`/async/single`, `/async/multiple`
Download & Retrieval	100 requests/min	`/download/`, `/design/parameter/`, `/designs`
Generation Status	300 requests/min	`/status/*` (for polling; separate from the download limit)

Rate Limit Exceeded Response

When the rate limit is exceeded, the following response is returned:

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json

{
  "statusCode": 429,
  "code": "RATE_LIMITED",
  "message": "Rate limit exceeded for this workspace. Please try again in 60 seconds.",
  "error": "Too Many Requests",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#rate_limited",
  "retryAfter": 60
}

The response includes a Retry-After header indicating the integer number of seconds to wait before retrying (per RFC 9110 §10.2.3). Clients should read this header and wait the specified duration rather than applying their own exponential backoff. The number embedded in the message body is the same value in human-readable form.

Design Rationale

Sync Endpoints (30 req/min): Sized to ECS task capacity, allowing for up to 60 seconds (the timeout) per request.
Async Endpoints (100 req/min): Supports batch processing and bulk generation. Protects server resources while maintaining high throughput.
Download (100 req/min): Higher limit for lightweight operations.
Generation Status (300 req/min): A separate allowance so that polling for async completion does not use up the download limit.

tip

For normal UI operations (approximately 1 request every 2 seconds), you won't reach the limit. For batch processing, please use async endpoints.

📝 Filename Restrictions

Disallowed Characters

The following characters cannot be used in filenames:

Character	Name
`/`	Slash
`\`	Backslash
`:`	Colon
`*`	Asterisk
`?`	Question mark
`"`	Double quote
`<` `>`	Angle brackets
`\|`	Pipe
Control chars	`0x00`–`0x1F`

All other characters (alphanumeric, Japanese, spaces, various symbols, etc.) are allowed.

Examples

✅ Valid:
{
  "fileName": "invoice_2024-01.pdf",
  "fileName": "report-2024-01.pdf",
  "fileName": "レポート (January).pdf",
  "fileName": "report #001.pdf"
}

❌ Invalid:
{
  "fileName": "invoice/2024.pdf",  // Slash not allowed
  "fileName": "data:2024.pdf",     // Colon not allowed
  "fileName": "report*.pdf"        // Asterisk not allowed
}

🔐 Security Requirements

HTTPS Required

The production environment only accepts HTTPS connections. HTTP requests are automatically redirected to HTTPS.

# ✅ Correct
curl -X POST https://api.re-port-flow.com/v1/file/sync/single \
  -H "appkey: your-app-key"

# ❌ Incorrect (HTTP not allowed)
curl -X POST http://api.re-port-flow.com/v1/file/sync/single

TLS Version

TLS for the API (api.re-port-flow.com) is terminated at Cloudflare, with the minimum TLS version set to 1.2 (TLS 1.0 / 1.1 cannot connect). Use a client that supports TLS 1.2 or later (TLS 1.3 recommended); see Trust.

API Endpoint

Production:

URL: https://api.re-port-flow.com/v1/*

Staging:

URL: https://api.stg.re-port-flow.com/v1/*

Authentication Failure:

{
  "statusCode": 401,
  "code": "INVALID_CREDENTIALS",
  "message": "Invalid API key or access token.",
  "error": "Unauthorized",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#invalid_credentials"
}

API Key Rotation

For improved security, we recommend regenerating your application key every 3 months.

See API Key Management for details.

📊 Plan Limits

Workspace plans have the following restrictions:

Template Limit

Each plan has a maximum number of templates that can be created in a workspace.

PDF Output Page Limit

The FREE and Personal plans have a monthly limit on the number of PDF pages you can output; output stops once it is reached (403 PLAN_PAGE_LIMIT_EXCEEDED). The Standard and Premium plans do not stop at a limit: pages beyond the included amount are billed as overage. Both the limit and the included amount count total pages output, not the number of output requests (outputting one 10-page PDF consumes 10 pages).

info

Specific limits vary by plan. Check your current usage and limits in the admin dashboard.

Exceeding Plan Limits

When the workspace plan cannot be found:

{
  "statusCode": 403,
  "code": "PLAN_NOT_FOUND",
  "message": "This operation is not allowed because the workspace plan could not be found.",
  "error": "Forbidden",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#plan_not_found"
}

When the monthly PDF output page limit is reached, the server returns (X is the plan's page limit):

{
  "statusCode": 403,
  "code": "PLAN_PAGE_LIMIT_EXCEEDED",
  "message": "Monthly page limit reached (X pages). Upgrade your plan or wait until next month.",
  "error": "Forbidden",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#plan_page_limit_exceeded"
}

On the Personal plan (no additional pages can be purchased), message is the following instead (code stays PLAN_PAGE_LIMIT_EXCEEDED):

Monthly page limit reached (X pages). The Personal plan has no additional pages. Upgrade to the Standard plan or wait until next month.

🌐 Network Restrictions

Requests via Cloudflare

Requests to the API (api.re-port-flow.com) are processed via Cloudflare:

Client → Cloudflare → ALB → ECS (content-service)

📋 Additional Restrictions

Health Check Endpoint

The /v1/health/check endpoint is accessible without authentication. This endpoint is not logged in access logs.

CORS Configuration

Requests from all origins (*) are accepted. The request headers a browser may send in a cross-origin call are:

Origin
X-Requested-With
X-Request-ID
Idempotency-Key
Content-Type
Accept
appkey
SecretKey (accepted but not used for authentication)
Authorization
Accept-Language

The response headers browser JavaScript can read are:

Content-Disposition
File-URL
File-ID
Request-Id
X-File-Mapping
Retry-After
X-Request-ID
X-Page-Count

🆘 What should I do when I hit a limit?

Each kind of overage has its own fix: optimise images and split the payload for size, switch to an async endpoint for timeouts, and upgrade the plan for plan-level caps.

Request Size Exceeded

Optimize images
Split data
Use async endpoints

Timeout

Use async endpoints (/async/single, /async/multiple)
Simplify the template
Split requests

Plan Limit Exceeded

Upgrade plan in admin dashboard
Delete unnecessary templates
Adjust usage frequency

📞 Support

For questions or support regarding limitations:

Email: [email protected]
Admin Dashboard: https://re-port-flow.com/support

Changelog

Date	Changes
2026-02-15	Initial version

📦 How large can a request be?​

Maximum Request Size: 50MB​

Behavior on Exceeding Limit​

Handling Large Files​

⏱️ Timeout Limits​

Sync Endpoints: 60 seconds​

Async Endpoints: No Limit​

🚦 Rate Limit​

Workspace-based Limits​

Rate Limit Exceeded Response​

Design Rationale​

📝 Filename Restrictions​

Disallowed Characters​

Examples​

🔐 Security Requirements​

HTTPS Required​

TLS Version​

API Endpoint​

API Key Rotation​

📊 Plan Limits​

Template Limit​

PDF Output Page Limit​

Exceeding Plan Limits​

🌐 Network Restrictions​

Requests via Cloudflare​

📋 Additional Restrictions​

Health Check Endpoint​

CORS Configuration​

🆘 What should I do when I hit a limit?​

Request Size Exceeded​

Timeout​

Plan Limit Exceeded​

📞 Support​

Changelog​