Quotas and limits

This document lists content limits and rate quotas for Google Cloud Fraud Defense.

Rate quotas

The following table lists the API usage quotas for Fraud Defense:

Quota	Value
Requests per calendar month per organization (if billing is not enabled)	10,000
Requests per minute	60,000
MFA Requests using email per email address per day	10
MFA Requests using SMS per phone number per day	10
MFA Requests using SMS per phone number per 4 hours	5
MFA Requests (email/SMS) per day	10,000

Note: The free 10,000 assessments are per organization. The limit aggregates use across all accounts and all sites. All rate limits (such as requests per minute) apply separately for each Google Cloud project.

Quota limit errors

When your API usage exceeds the specified quota limits, any new request returns an HTTP error with a Resource Exhausted (429) status code.

For V2, an end-user-visible error message is shown similar to the following message: This site is exceeding reCAPTCHA quota.

What to do if you expect to go over the quotas

To use Fraud Defense above the monthly free quota of 10,000 assessments per organization, enable billing for your Google Cloud project. The monthly assessment quota is reset across your organization on the first day of each calendar month.

If you expect to exceed other quotas, reach out to your assigned Google Cloud sales representative. If you don't have an assigned Google Cloud sales representative, contact Google Cloud sales.

For more information about quota errors and status codes, see Troubleshoot quota errors.

Endpoint behavior when exceeding the monthly free quota

A Google Cloud project without an active billing account is subject to a free tier limit of 10,000 assessments per month across the organization. When this quota is exceeded across all accounts and all sites, the CreateAssessment and SiteVerify endpoints exhibit different behavior:

• CreateAssessment: Requests that exceed the quota fail in a closed state. This means that the API returns an error, typically an HTTP 429 (Too Many Requests) status code or a RESOURCE_EXHAUSTED error. When this occurs, no assessment is created. To help prevent this, over-quota notifications and emails can alert you about a missing billing account.

• SiteVerify: Requests that exceed the quota fail in an open state. The API returns an HTTP 200 (OK) status. The response body indicates success:true but contains a static score of 0.9 and an error message indicating that you exceeded the quota. This behavior is designed to prevent valid users from being blocked.