> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Set usage limits (editor; audited) > Sets the usage limits for each source account, fee included: `perTransactionMax`, `dailyMax` (calendar day, Brasília time), and `monthlyMax`, with `perTransactionMax ≤ dailyMax ≤ monthlyMax`. An omitted ceiling sets no limit. `enabled=false` turns off the count. Required before the first transfer. Usage is put on hold when you create a transfer and released if the transfer is rejected or cancelled. If a limit is exceeded, 422 `TED-0030`. Audited. Requires `X-Idempotency`. If the audit trail cannot record the change, TED Lerian refuses it with 503 `TED-9002` and changes nothing: only the audit trail keeps the previous value. Reads stay available. ## OpenAPI ````yaml /en/openapi/v3-current/ted-lerian.yaml put /v1/policy/limits openapi: 3.1.0 info: description: >- API of **TED Lerian**, the interface over Lerian SPB. Your institution uses it to send TEDs, make internal transfers, track incoming TEDs, and operate returns, queues, and policy on its Midaz ledger. The [API overview](/en/reference/interfaces/ted-lerian/ted-lerian-api-overview) gives the concepts, the roles, and the conventions. title: TED Lerian API version: v1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Outgoing TEDs and internal transfers: fee quote, creation, query, timeline, and cancellation. Every integration starts here. name: Transfers - description: >- Incoming TEDs from other institutions: query, timeline, and operator actions (full return and manual review resolution). name: Incoming Transfers - description: >- STR participant list, to resolve COMPE code ↔ ISPB and validate the destination bank before you create a transfer. name: Participants - description: >- Back office: operations queue, inconsistency findings between the ledger and the STR, reviews of rail facts, held returns, and manual unblock with evidence. name: Reconciliation - description: >- Operations dashboard: daily aggregates, regulatory deadlines (30/60/60 min), and the closing balance that the STR reported. name: Operations - description: >- Institution configuration (editor): operating window and cut-off, usage limits, holiday calendar, and ISPB → organization bindings. name: Policy paths: /v1/policy/limits: put: tags: - Policy summary: Set usage limits (editor; audited) description: >- Sets the usage limits for each source account, fee included: `perTransactionMax`, `dailyMax` (calendar day, Brasília time), and `monthlyMax`, with `perTransactionMax ≤ dailyMax ≤ monthlyMax`. An omitted ceiling sets no limit. `enabled=false` turns off the count. Required before the first transfer. Usage is put on hold when you create a transfer and released if the transfer is rejected or cancelled. If a limit is exceeded, 422 `TED-0030`. Audited. Requires `X-Idempotency`. If the audit trail cannot record the change, TED Lerian refuses it with 503 `TED-9002` and changes nothing: only the audit trail keeps the previous value. Reads stay available. operationId: updateUsageLimits parameters: - description: >- Replay window of the idempotency key, in seconds. Default 300 (5 minutes) when missing or invalid. Values outside 30 s to 7 days are adjusted to these limits. Only the value of the FIRST request for a key counts. A change to X-TTL on retries has no effect. The window sets how long the response is replayed. in: header name: X-TTL schema: minimum: 1 type: integer - description: >- Idempotency key of the change. Required: a request without it is refused with `400` `TED-0011`. in: header name: X-Idempotency required: true schema: type: string - $ref: '#/components/parameters/XRequestId' requestBody: content: application/json: examples: default: summary: Limits per transfer, day, and month value: dailyMax: '200000.00' enabled: true monthlyMax: '1000000.00' perTransactionMax: '50000.00' schema: $ref: '#/components/schemas/UsageLimits' required: true responses: '200': content: application/json: example: dailyMax: '200000.00' enabled: true monthlyMax: '1000000.00' perTransactionMax: '50000.00' updatedAt: '2026-10-22T12:00:00Z' updatedBy: admin@instituicao.example schema: $ref: '#/components/schemas/UsageLimits' description: >- Configuration saved and audited; the body returns the current configuration. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '400': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- Malformed JSON (`TED-0001`) or `X-Idempotency` missing/in the wrong format (`TED-0011`). headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: 'Not authenticated: token missing, invalid, or expired (`TED-0070`).' headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- No permission: the token's role does not authorize this action, or the product license is not valid for the organization (`TED-0071`). headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Invalid fields (`TED-0002`, see `errors`). headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- Unexpected failure (`TED-9000`). Retry with the SAME `X-Idempotency`. If it continues, contact support and give the `X-Request-Id` of the response. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- The audit trail cannot record the change (`TED-9002`). Nothing changed. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' components: parameters: XRequestId: description: >- Correlation identifier of this request (UUID). Optional: when you omit it, or when the value is not a well-formed UUID, the platform creates a UUID and returns it in the X-Request-Id header of the response. The resolved identifier goes to the logs, spans, and audit events of this request. Keep it to open a support ticket. in: header name: X-Request-Id schema: format: uuid type: string schemas: UsageLimits: additionalProperties: false description: >- Usage limits of the institution per account: maximum amount per transfer, per business day, and per month. A missing limit sets no cap. properties: dailyMax: description: >- Maximum amount (BRL, two decimal places) per source account per calendar day (Brasília time). Absent = no cap. examples: - '1500.00' pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$ type: string enabled: description: >- If the limits apply. With false, the service does not count or refuse send requests. type: boolean monthlyMax: description: >- Maximum amount (BRL, two decimal places) for each source account per calendar month (Brasília time). Missing = no ceiling. examples: - '1500.00' pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$ type: string perTransactionMax: description: >- Maximum amount (BRL, two decimal places) of one transfer, fee included. Absent = no cap. examples: - '1500.00' pattern: ^(0|[1-9][0-9]{0,11})\.[0-9]{2}$ type: string updatedAt: description: Instant (UTC) of the last write. Ignored on write. format: date-time readOnly: true type: string updatedBy: description: >- Who wrote it last. Ignored on write; it comes from the authenticated identity. readOnly: true type: string required: - enabled type: object Detail: additionalProperties: true description: >- Standard error body (RFC 9457, `application/problem+json`) for every `/v1` operation. Use `code` (TED-NNNN) to handle the error in code, `detail` for the readable message, and `errors` for the invalid fields of a 422. The `X-Request-Id` of the response identifies the occurrence for support. properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false description: >- An invalid field inside a validation error: where it is (`location`), what is wrong (`message`), and the value received. properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false description: >- Error reported by an upstream system (ledger or rail), when the service chooses to expose it. Absent in most errors. properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object headers: XRequestId: description: >- Echo of the request X-Request-Id: the value that the client sent, or the UUID that the platform generated when the client sent none. Present in every response, success or error. schema: format: uuid type: string securitySchemes: BearerAuth: bearerFormat: JWT description: >- JWT token that the Lerian Access Manager issues for your institution. Send it in `Authorization: Bearer ` on every call (except the public health probes). The tenant never comes from the body, the query, or the path. Each operation requires a role with the matching permission (see the API overview). Without it, 403 `TED-0071`. Missing, invalid, or expired token: 401 `TED-0070`. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.