Skip to content
Oriel

Query budgets and rate limits

Oriel has two separate limit systems. Query budgets protect ClickHouse-backed telemetry reads. Rate limits protect public auth, invite, signup, and feature flag SDK endpoints through Valkey.

Query budgets

Section titled “Query budgets”

Query settings live under [query]:

[query]
deadline = "25s"
max_execution = "15s"
scan_budget_aggregate = 4000000000
scan_budget_list = 1000000000
Key Default Effect
deadline 25s End-to-end HTTP request deadline for query handling.
max_execution 15s ClickHouse max_execution_time compiled into OQL plans.
scan_budget_aggregate 4000000000 max_rows_to_read for aggregate-shaped queries.
scan_budget_list 1000000000 max_rows_to_read for list-shaped queries.

Use lower budgets to fail expensive queries earlier. Use higher budgets only after checking ClickHouse capacity and the query pattern that is hitting ORL-2004 or ORL-2005.

Rate limits

Section titled “Rate limits”

Rate limits live under [rate_limit] and require Valkey:

[rate_limit]
enabled = true
window = "1m"
auth_attempts = 10
signup_attempts = 5
invitation_attempts = 20
sdk_requests = 600
Key Default Protects
auth_attempts 10 Login and OIDC start/callback attempts.
signup_attempts 5 Public signup attempts.
invitation_attempts 20 Invitation preview and accept endpoints.
sdk_requests 600 Feature flag SDK evaluate, ruleset, and stream endpoints.

The fixed window is per client identity. Disabling rate limits removes this guard from public endpoints; it does not remove OQL scan budgets.

Environment overrides

Section titled “Environment overrides”
Terminal window
ORIEL_QUERY_DEADLINE=30s
ORIEL_QUERY_MAX_EXECUTION=20s
ORIEL_QUERY_SCAN_BUDGET_AGGREGATE=6000000000
ORIEL_QUERY_SCAN_BUDGET_LIST=1500000000
ORIEL_RATE_LIMIT_ENABLED=true
ORIEL_RATE_LIMIT_WINDOW=1m
ORIEL_RATE_LIMIT_AUTH_ATTEMPTS=10
ORIEL_RATE_LIMIT_SIGNUP_ATTEMPTS=5
ORIEL_RATE_LIMIT_INVITATION_ATTEMPTS=20
ORIEL_RATE_LIMIT_SDK_REQUESTS=600

Verify changes

Section titled “Verify changes”

Run:

Terminal window
oriel --config /etc/oriel/oriel.toml doctor

For query budget changes, use Explore or POST /api/v1/workspaces/{ws}/oql/explain to inspect the compiled scan budget for a query shape. For rate-limit changes, check Valkey connectivity first; Oriel is not ready when Valkey is unavailable.