This document lists content limits and rate quotas for
Google Cloud Fraud Defense.

## Rate quotas

The following table lists the API usage quotas for Fraud Defense:

| Quota | Value |
|---|---|
| Requests per calendar month per organization (if billing is not enabled) | 10,000 |
| Requests per minute | 60,000 |
| MFA Requests using email per email address per day | 10 |
| MFA Requests using SMS per phone number per day | 10 |
| MFA Requests using SMS per phone number per 4 hours | 5 |
| MFA Requests (email/SMS) per day | 10,000 |

> [!NOTE]
> **Note:** The free 10,000 assessments are per organization. The limit aggregates use across all accounts and all sites. All rate limits (such as requests per minute) apply separately for each Google Cloud project.

## Quota limit errors

When your API usage exceeds the specified quota limits, any new request returns
an HTTP error with a `Resource Exhausted (429)` status code.

For V2, an end-user-visible error message is shown similar to the following
message: `This site is exceeding reCAPTCHA quota`.

## What to do if you expect to go over the quotas

To use Fraud Defense above the monthly free quota of 10,000 assessments per organization,
[enable billing](https://docs.cloud.google.com/billing/docs/how-to/modify-project.md.txt#enable_billing_for_a_project)
for your Google Cloud project. The monthly assessment quota is reset across your organization on the
first day of each calendar month.

If you expect to exceed other quotas, reach out to your assigned Google Cloud sales
representative. If you don't have an assigned Google Cloud sales
representative, [contact Google Cloud sales](https://cloud.google.com/contact/).

For more information about quota errors and status codes, see
[Troubleshoot quota errors](https://docs.cloud.google.com/docs/quotas/troubleshoot.md.txt).

### Endpoint behavior when exceeding the monthly free quota

A Google Cloud project without an active billing account is subject to a free tier
limit of 10,000 assessments per month across the organization. When this quota
is exceeded across all accounts and all sites, the `CreateAssessment` and
`SiteVerify` endpoints exhibit different behavior:

- `CreateAssessment`: Requests that exceed the quota fail in a closed state.
  This means that the API returns an error, typically an `HTTP 429 (Too Many
  Requests)` status code or a `RESOURCE_EXHAUSTED` error. When this occurs, no
  assessment is created. To help prevent this, over-quota notifications and
  emails can alert you about a missing billing account.

- `SiteVerify`: Requests that exceed the quota fail in an open state. The API
  returns an `HTTP 200 (OK)` status. The response body indicates `success:true`
  but contains a static score of 0.9 and an error message indicating that you
  exceeded the quota. This behavior is designed to prevent valid users from
  being blocked.