PLAN_LIMIT_REACHED

The plan's limit is reached.

Checked 2026-09-28

The plan's limit is reached.

HTTP 402 · gRPC FAILED_PRECONDITION · the error body

#Returned by

Method	Scope	What it does
`access.orgs.create`	`access:admin`	Creates an org. Access assigns the id.
`access.projects.create`	`access:admin`	Creates a project. Access assigns the id.
`access.envs.create`	`access:admin`	Creates an environment. Access assigns the id.
`access.api_keys.create`	`access:keys:write`	Creates an API key. Access assigns the id.
`agents.agents.create`	`agents:write`	Creates an agent and its version 1.
`agents.agent_sessions.create`	`agents:sessions`	Starts a session of an agent, pinned to its current version unless `agent_version` names another. Requires a secret key until end-user ownership is implemented. The session starts idle; `:send` starts its first turn.
`agents.memory_stores.create`	`agents:write`	Creates a memory store.
`agents.memories.create`	`agents:write`	Writes a memory.
`artifacts.artifacts.create`	`artifacts:write`	Registers an artifact whose bytes were pushed by digest; verification runs after.
`auth.end_users.create`	`auth:write`	Creates an end user.
`auth.customer_organizations.create`	`auth:write`	Creates a customer organization.
`auth.memberships.create`	`auth:write`	Creates a membership.
`auth.organization_roles.create`	`auth:write`	Creates an organization role.
`auth.invitations.create`	`auth:write`	Creates an invitation.
`auth.email_domains.create`	`auth:write`	Creates an email domain; the answer names the TXT record to publish.
`auth.oauth_clients.create`	`auth:write`	Creates an OAuth client.
`broker.trust_policies.create`	`broker:admin`	Creates a trust policy.
`build.builds.create`	`build:run`	Creates a build: one command or one image over a commit or a tree. The Operation is done when the build reaches a final state. `run` and `image` are the short forms.
`build.builds.run`	`build:run`	Runs one command over an uploaded tree and settles with its exit code, like the local command. A caller that gets a failure before the command started (BUILD_FAILURE_SETUP_FAILED, NO_CAPACITY) may build locally.
`build.builds.build_image`	`build:run`	Builds an image, with an SBOM and signed provenance, from a commit or an uploaded tree.
`config.config_flags.create`	`config:write`	Creates a config flag; the Operation is done when every cell serves it.
`connections.connection_providers.create`	`connections:admin`	Creates a connection provider.
`connections.connections.create`	`connections:write`	Records an installation; the controller confirms it with the provider.
`data.databases.create`	`data:write`	Creates a database. The Operation is done when the controller settles it.
`data.kv_namespaces.create`	`data:write`	Creates a kv namespace. The Operation is done when the controller settles it.
`data.buckets.create`	`data:write`	Creates a bucket. The Operation is done when the controller settles it.
`data.search_indexes.create`	`data:write`	Creates a search index. The Operation is done when the controller settles it.
`events.topics.create`	`events:write`	Creates a topic.
`events.subscriptions.create`	`events:write`	Creates a subscription.
`events.queues.create`	`events:write`	Creates a queue.
`events.webhook_endpoints.create`	`events:write`	Creates a webhook endpoint.
`events.inbound_endpoints.create`	`events:write`	Creates an inbound endpoint.
`events.realtime_channels.create`	`events:write`	Creates a realtime channel.
`hosting.services.create`	`hosting:write`	Creates a service. The Operation is done when the controller settles it.
`hosting.service_rollouts.create`	`hosting:write`	Creates a rollout.
`hosting.previews.create`	`hosting:write`	Creates a preview. The Operation is done when the controller settles it.
`hosting.source_links.create`	`hosting:write`	Creates a source link. The Operation is done when the controller settles it.
`keys.keys.create`	`keys:write`	Creates a key; the signer generates its first version.
`knowledge.spaces.create`	`knowledge:write`	Creates a space.
`knowledge.knowledge_schemas.create`	`knowledge:write`	Creates a knowledge schema.
`localization.catalogs.create`	`localization:write`	Creates a catalog.
`localization.glossaries.create`	`localization:write`	Creates a glossary.
`money.usage_reservations.create`	`billing:metering:write`	Reserves usage before the work starts. Refused with PLAN_LIMIT_REACHED (spend limit, no payment method) or INVALID_STATE (suspended) only while enforcement is on; while it is dark the reservation is granted and the refusal is recorded.
`network.domains.create`	`network:write`	Creates a domain. The Operation is done when the controller settles it.
`network.routes.create`	`network:write`	Creates a route. The Operation is done when the controller settles it.
`network.egress_identities.create`	`network:write`	Creates an egress identity. The Operation is done when the controller settles it.
`network.private_links.create`	`network:write`	Creates a private link. The Operation is done when the controller settles it.
`notify.mail_domains.create`	`notify:write`	Creates an email domain.
`notify.mail_routes.create`	`notify:write`	Creates a route.
`notify.senders.create`	`notify:write`	Creates a sender.
`notify.recipients.create`	`notify:write`	Creates a recipient.
`notify.suppressions.create`	`notify:write`	Creates a suppression.
`notify.templates.create`	`notify:write`	Creates a template.
`notify.messages.create`	`notify:send`	Sends a Message.
`notify.mailboxes.create`	`notify:write`	Creates a mailbox.
`notify.broadcasts.create`	`notify:write`	Creates a broadcast.
`release.releases.create`	`release:write`	Creates a release: admits it and rolls it out in waves. The Operation is done when the release is live or halted.
`runners.scale_sets.create`	`runners:write`	Creates a scale set. The Operation is done when the controller settles it.
`sandboxes.pools.create`	`sandboxes:write`	Creates a pool. The Operation is done when the controller settles it.
`sandboxes.leases.create`	`sandboxes:write`	Creates a lease: granted now and returned READY (or GRANTED when `wait_ready` is false), or refused with a typed error. There is no queue.
`sandboxes.volumes.create`	`sandboxes:write`	Creates a volume.
`sandboxes.snapshots.create`	`sandboxes:write`	Captures a running lease's disk as a snapshot.
`secrets.secrets.create`	`secrets:write`	Creates a secret, without a value; add one with CreateSecretVersion.
`secrets.secret_versions.create`	`secrets:write`	Adds a value to a secret as its newest version. The value is never returned.
`secrets.secret_bindings.create`	`secrets:write`	Creates a secret binding.
`workflows.workflows.create`	`workflows:write`	Creates a workflow.
`workflows.schedules.create`	`workflows:write`	Creates a schedule.
`workflows.runs.create`	`workflows:run`	Starts a Run of a Workflow, now or after `start_delay` or at `schedule_time`. `run_id` is the caller's key: the same key and intent return the same Run, a changed intent is refused. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.runs.start_batch`	`workflows:run`	Starts a batch: a parent Run that fans out one child Run per item, each with a stable index and count.
`workflows.jobs.create`	`workflows:write`	Creates a job.
`workflows.job_runs.create`	`workflows:run`	Starts a run of a Job now. The same `Idempotency-Key` returns the same run for 24h; a Schedule fire uses `{job}:{intended time}`. With concurrency `forbid`, a start while a run is active fails with INVALID_STATE.
`workflows.distributed_jobs.create`	`workflows:write`	Creates a distributed job.
`workflows.distributed_runs.create`	`workflows:run`	Starts a run of a distributed job. The same `Idempotency-Key` returns the same run for 24h.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links