# Request limits

Reject oversized input rather than silently shortening it.

| Limit | Current contract |
| --- | --- |
| Encoded request body | At most 4 MB (4,000,000 bytes) |
| Decompressed request body | At most 4 MB (4,000,000 bytes) |
| Complete model input | At most 2048 tokenizer tokens |
| Choice options | 2–255 |
| Score levels | 2–10, strictly increasing numeric string IDs from 1 through 10 |
| Option ID | 1–128 characters, unique and nonblank |
| JSON nesting | At most 64 levels |
| Compression | One layer of `gzip`, `x-gzip`, or `zstd`; zstd window at most 8 MiB |

The 4 MB transport limit applies independently to the encoded and decompressed bodies. A body above either cap receives `413`. This is separate from the 2048-token model limit.

The token limit includes the situation, question, option descriptions, and model formatting. It is checked with the actual inference tokenizer. Character count and an unrelated tokenizer are not reliable substitutes. Over-limit input is rejected with `413`, never truncated.

Send UTF-8 JSON using `Content-Type: application/json`. Use finite numbers only; do not include a byte order mark. Nesting beyond 64 levels receives `400`. Unsupported media types, encodings, and stacked encodings receive `415`; malformed JSON or compression receives `400`. A structurally invalid decision, including an option or level count outside the ranges above or an unknown field at any level, receives `422`.

## Compression

Compression saves transport bytes, not model tokens. Both compressed and decompressed sizes must fit. Set `Content-Encoding` to the format you actually send:

```bash
printf '%s' '{"model":"ren-latest","type":"noul","situation":"Please cancel my plan.","question":"Is cancellation explicitly requested?"}' \
  | gzip \
  | curl --fail-with-body https://api.secndai.com/v1/decide \
      -H "Authorization: Bearer $SECND_API_KEY" \
      -H 'Content-Type: application/json' \
      -H 'Content-Encoding: gzip' \
      --data-binary @-
```

Use the body for the question and evidence. Do not add images, multipart data, arbitrary metadata, or few-shot examples: those are not supported request fields.