---
title: "Limits over the API"
description: "Read, set, change, reset and remove volume limits over REST on advertisers, campaigns, banners, sites and placements — the endpoints, date formats, per-cap permissions and error answers."
type: "reference"
audience: [network-manager]
keywords: [limits api, rest api, set.do, update.do, reset.do, ignoredFields, fieldsHiddenByPermission, timezoneOffset, useLocalTime, reset all counters]
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Limits over the API

Limits can be read, set, changed, reset and removed over REST on all five levels. The full
parameter list is in [Targeting, capping and limits via API](https://epom.com/ad-server/docs/api/targeting-capping-limits.md);
what follows is how the endpoints behave.

## Who this is for

- **Integrators** who manage caps from their own system instead of the Limits card. The caller
  needs the same access to the entity and the same per-cap permissions as on the card — see
  [Set volume limits and budgets](https://epom.com/ad-server/docs/guides/delivery/limits.md) for what each role is granted by default.

## Endpoints

| Level | Endpoints |
|---|---|
| Advertiser, campaign, banner | `GET` / `DELETE` `/rest-api/{advertiser\|campaign\|banner}/{id}/limits.do`, `POST` `…/limits/set.do`, `…/limits/update.do`, `…/limits/reset.do` |
| Site, placement | The same five operations under `/rest-api/site/{id}/limits.do` and `/rest-api/placement/{id}/limits.do` |

## How the endpoints behave

- **`set.do` creates the limit record when there is none; `update.do` answers `404`** and points
  at `set.do`. Both merge: a field you leave out keeps its stored value.
- **Counters cannot be written.** The spent figures (`totalImpressions` and the other names
  without the `Limit` suffix) are read-only: sent, they come back in `ignoredFields` with the
  reason and nothing changes. `reset.do` is the way to zero one.
- **Dates** are `yyyy-MM-dd-HH-mm` (or `yyyy-MM-dd HH:mm`) in GMT+0, or in the caller's local
  time with `useLocalTime=true` and a `timezoneOffset` in minutes east of UTC. A date the binder
  cannot read is a `400` that names both accepted formats and gives an example. A read answers
  in UTC unless it is passed the same `timezoneOffset`; on a local-time limit it then answers
  the dates in that offset and echoes the `timezoneOffset`.
- **Every cap needs its own permission**, the one behind its row on the card (*Weekly Clicks
  Limit*, *Monthly Budget* …). On an advertiser, campaign or banner, a cap that would change
  without its permission is left as stored and comes back in `ignoredFields`, its
  `ignoredFieldReasons` entry naming the permission; the caps the role may set are saved. A cap
  sent with the value it already has needs no permission. On a site or placement a request
  carrying a cap the role lacks is a `403` that names the permission, and nothing is saved.
  A read leaves such a cap out, and on a site or placement lists it in `fieldsHiddenByPermission`.
  A value outside the column range, or a cap above a longer period's, is a `400` naming the
  field. A missing or deleted entity is a `404`; missing access to the entity or *Manage Capping &
  Limitations* is a `403`, and so is a `reset.do` of a counter without its permission.
- **On a site or placement the card's own rules carry over.** Reading needs a share on the site
  and *Manage Site and Placement Limits* (read-only is enough); changing needs update rights and
  the same permission; creating or removing the record needs *Manage Capping & Limitations*.
  Budget and opportunity fields do not exist there and answer `400`; request caps do.

## Corner cases and gotchas

> **Corner case — "reset all counters" exists only on the demand side of the API.** The card
> has no clear-everything button; each eraser clears exactly its own counter. The advertiser,
> campaign and banner reset endpoints accept the all-counters value `ALL`, which zeroes 22
> counters (every delivery counter and the CPA pair) — none of them a requests counter. The
> site and placement reset endpoints refuse `ALL` and any counter a site limit does not have
> with a `400`; name the counters you want cleared. Do not send `ALL_ACTION_LIMITS` to the reset
> endpoints either — it is not a supported reset value; name the counters instead.

## Related

- [Set volume limits and budgets](https://epom.com/ad-server/docs/guides/delivery/limits.md)
- [How limits behave](https://epom.com/ad-server/docs/guides/delivery/limits-how-caps-behave.md)
- [Targeting, capping and limits via API](https://epom.com/ad-server/docs/api/targeting-capping-limits.md)
- [Per-action limits](https://epom.com/ad-server/docs/guides/delivery/action-limits.md)
- [Platform limits](https://epom.com/ad-server/docs/reference/platform-limits.md)