Set usage limits (editor; audited)

curl --request PUT \
  --url https://api.example.com/v1/policy/limits \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "dailyMax": "200000.00",
  "enabled": true,
  "monthlyMax": "1000000.00",
  "perTransactionMax": "50000.00"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/policy/limits"

	payload := strings.NewReader("{\n  \"dailyMax\": \"200000.00\",\n  \"enabled\": true,\n  \"monthlyMax\": \"1000000.00\",\n  \"perTransactionMax\": \"50000.00\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("X-Idempotency", "<x-idempotency>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {
    'X-Idempotency': '<x-idempotency>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    dailyMax: '200000.00',
    enabled: true,
    monthlyMax: '1000000.00',
    perTransactionMax: '50000.00'
  })
};

fetch('https://api.example.com/v1/policy/limits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/policy/limits"

payload = {
    "dailyMax": "200000.00",
    "enabled": True,
    "monthlyMax": "1000000.00",
    "perTransactionMax": "50000.00"
}
headers = {
    "X-Idempotency": "<x-idempotency>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "dailyMax": "200000.00",
  "enabled": true,
  "monthlyMax": "1000000.00",
  "perTransactionMax": "50000.00",
  "updatedAt": "2026-10-22T12:00:00Z",
  "updatedBy": "admin@instituicao.example"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Set usage limits (editor; audited)

Sets the usage limits for each source account, fee included: perTransactionMax, dailyMax (calendar day, Brasília time), and monthlyMax, with perTransactionMax ≤ dailyMax ≤ monthlyMax. An omitted ceiling sets no limit. enabled=false turns off the count.

Required before the first transfer. Usage is put on hold when you create a transfer and released if the transfer is rejected or cancelled. If a limit is exceeded, 422 TED-0030. Audited. Requires X-Idempotency.

If the audit trail cannot record the change, TED Lerian refuses it with 503 TED-9002 and changes nothing: only the audit trail keeps the previous value. Reads stay available.

PUT

policy

limits

Set usage limits (editor; audited)

curl --request PUT \
  --url https://api.example.com/v1/policy/limits \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "dailyMax": "200000.00",
  "enabled": true,
  "monthlyMax": "1000000.00",
  "perTransactionMax": "50000.00"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/policy/limits"

	payload := strings.NewReader("{\n  \"dailyMax\": \"200000.00\",\n  \"enabled\": true,\n  \"monthlyMax\": \"1000000.00\",\n  \"perTransactionMax\": \"50000.00\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("X-Idempotency", "<x-idempotency>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {
    'X-Idempotency': '<x-idempotency>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    dailyMax: '200000.00',
    enabled: true,
    monthlyMax: '1000000.00',
    perTransactionMax: '50000.00'
  })
};

fetch('https://api.example.com/v1/policy/limits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/policy/limits"

payload = {
    "dailyMax": "200000.00",
    "enabled": True,
    "monthlyMax": "1000000.00",
    "perTransactionMax": "50000.00"
}
headers = {
    "X-Idempotency": "<x-idempotency>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "dailyMax": "200000.00",
  "enabled": true,
  "monthlyMax": "1000000.00",
  "perTransactionMax": "50000.00",
  "updatedAt": "2026-10-22T12:00:00Z",
  "updatedBy": "admin@instituicao.example"
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Authorizations

Authorization

string

header

required

JWT token that the Lerian Access Manager issues for your institution. Send it in Authorization: Bearer <token> on every call (except the public health probes). The tenant never comes from the body, the query, or the path. Each operation requires a role with the matching permission (see the API overview). Without it, 403 TED-0071. Missing, invalid, or expired token: 401 TED-0070.

Headers

X-TTL

integer

Replay window of the idempotency key, in seconds. Default 300 (5 minutes) when missing or invalid. Values outside 30 s to 7 days are adjusted to these limits. Only the value of the FIRST request for a key counts. A change to X-TTL on retries has no effect. The window sets how long the response is replayed.

Required range: x >= 1

X-Idempotency

string

required

Idempotency key of the change. Required: a request without it is refused with 400 TED-0011.

X-Request-Id

string<uuid>

Correlation identifier of this request (UUID). Optional: when you omit it, or when the value is not a well-formed UUID, the platform creates a UUID and returns it in the X-Request-Id header of the response. The resolved identifier goes to the logs, spans, and audit events of this request. Keep it to open a support ticket.

Body

application/json

Usage limits of the institution per account: maximum amount per transfer, per business day, and per month. A missing limit sets no cap.

enabled

boolean

required

If the limits apply. With false, the service does not count or refuse send requests.

dailyMax

string

Maximum amount (BRL, two decimal places) per source account per calendar day (Brasília time). Absent = no cap.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

monthlyMax

string

Maximum amount (BRL, two decimal places) for each source account per calendar month (Brasília time). Missing = no ceiling.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

perTransactionMax

string

Maximum amount (BRL, two decimal places) of one transfer, fee included. Absent = no cap.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

Response

Configuration saved and audited; the body returns the current configuration.

Usage limits of the institution per account: maximum amount per transfer, per business day, and per month. A missing limit sets no cap.

enabled

boolean

required

If the limits apply. With false, the service does not count or refuse send requests.

dailyMax

string

Maximum amount (BRL, two decimal places) per source account per calendar day (Brasília time). Absent = no cap.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

monthlyMax

string

Maximum amount (BRL, two decimal places) for each source account per calendar month (Brasília time). Missing = no ceiling.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

perTransactionMax

string

Maximum amount (BRL, two decimal places) of one transfer, fee included. Absent = no cap.

Pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$

Example:

"1500.00"

updatedAt

string<date-time>

read-only

Instant (UTC) of the last write. Ignored on write.

updatedBy

string

read-only

Who wrote it last. Ignored on write; it comes from the authenticated identity.

Overview

Transfers API

Incoming Transfers API

Reconciliation API

Operations API

Policy API

Participants API

Error handling

Set usage limits (editor; audited)

Authorizations

Headers

Body

Response