Firewall, rate limits and error pages

This page brings together what protects a project at the front door and what a visitor sees when a request is refused: the request budget the edge applies to each project, the limits on a single request, the API rate limits for your tokens, and the error pages you can customise. It also says what is not yet available.

The application firewall

A per-project application firewall that you configure (blocking rules, rate limiting per path, address lists) is planned through the firewall.configure operation. It is not yet available: the operation is declared in the registry, but no implementation answers it today, and the route returns 404. It is declared at the Owner rank and closed to agents, whatever their scope.

Meanwhile, a project is protected by the mechanisms below, which need no configuration. To restrict access to a preview (password, project members, list of IP addresses), see Previews.

The project's request budget

The edge keeps, for each project, a request budget derived from its tier. All the project's routes share it: its production, its previews and its deployments' addresses.

A burst goes through at full speed; beyond it, the edge answers 429 without your application seeing the request. The refusal carries Retry-After: 1 and the RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy headers. A refused request consumes nothing: a flood of refused requests does not delay the return of service.

This budget is applied before everything else: preview protection, routing rules, the cache and the application. A project caught in a spike therefore costs its neighbours nothing. It is not a commercial quota: requests are not billed on any tier.

Outbound traffic follows a related rule: beyond the tier's sustained outbound rate (20, 50, 200 and 500 Mb/s), the edge paces sending without refusing anything. See Limits.

Limits on a request

These limits apply to every name served by the platform. Each refusal is an HTTP response that names the limit, in French and in English.

API rate limits

The API counts calls per token, over a 60-second window:

Each response carries RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset (in seconds) and RateLimit-Policy, for example 600;w=60, 60;w=60. Beyond that, the call is refused with 429, the rate_limited code and a Retry-After. Each operation's reference page states its policies.

Tip. An agent polling the state of a long-running task should space out its reads: task_read keeps no connection open, and every read counts against the general policy.

Custom error pages

When the platform serves an error itself (application unreachable, timeout, rate limit, service suspended), the visitor sees a platform page, in French and in English. You can replace its title and message for seven codes.

A page is a title (100 characters at most) and a message (1,000 characters at most), in plain text, per code and per language (fr or en). A line break separates two paragraphs of the message. The < and > characters and control characters are refused. The edge writes this text into its own page, with its own style sheet: an error page loads no script and no external resource.

Pages are served by the edge without redeploying, even when your application is stopped. A code or language you do not set keeps the platform's page. An error your application returns itself, with its own body, remains its own.

These cannot be customised: the 403 of a project frozen for abuse, which carries the case reference, and the states that come before any project, such as an unknown host name or a pending certificate.

From the console

Open “Domaines” (Domains), then expand Pages d'erreur (Error pages) at the bottom of the screen. Each code has a title and a message per language; a field left empty keeps the platform's page. Enregistrer les pages (Save the pages) puts them online on the edge's next pass; Tout retirer (Remove all) restores the platform's pages.

From the command line or the API

errorpage.configure replaces the whole list: a page missing from the list is removed, and an empty list removes them all. It holds 14 pages at most (seven codes, two languages), without duplicates.

{
  "projectId": "prj_01JQ8ZK4M7NP2RSTVWXYZ34567",
  "pages": [
    {
      "status": 503,
      "language": "fr",
      "title": "Retour dans un instant",
      "message": "La boutique est en mise à jour.\nRevenez dans quelques minutes."
    },
    {
      "status": 503,
      "language": "en",
      "title": "Back in a moment",
      "message": "The shop is being updated.\nPlease come back in a few minutes."
    }
  ],
  "idempotencyKey": "maintenance-pages-2026-10-23"
}

bastide errorpage read --project-id prj_01JQ8ZK4M7NP2RSTVWXYZ34567
bastide errorpage configure --project-id prj_01JQ8ZK4M7NP2RSTVWXYZ34567 --pages "$(cat pages.json)"

Through the API: GET and PUT /v1/projects/{projectId}/error-pages on https://api.bastide.app. Setting pages requires the Maintainer rank; reading them, the Reader rank. These operations are reserved for a person: they have no MCP tool and are not open to service accounts.

Common errors

See also

• Previews
• Routing
• Cache and images
• Limits
• Security
• errorpage.configure, firewall.configure (operation pages, in French)

Report a mistake on this page