---
title: "Platform limits"
description: "Every hard limit a user can hit — upload sizes, field lengths, numeric ranges, login and password throttling — with the value that actually stops the save."
type: "reference"
audience: [network-manager, admin]
keywords: [limits, maximum, file size, upload, field length, name length, weight, capping range, login attempts, password policy, validation, character limit, decimal places]
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Platform limits

Every hard limit a user can run into: upload caps, field lengths, numeric ranges, and the
throttles on signing in. Each figure below is the value that **actually stops the save**.

Values marked *network preference* or *configurable by Epom* differ per network; the number
given is the default.

## How a limit is enforced

A form may stop you typing past a limit, but that is a convenience: the server checks every value
again when you save, through the form and through the REST API alike. A value outside its range is
refused with an error attached to the field, naming the limit, and nothing is saved. Where the
form allows less than the server would accept, the tables below give the server's figure and say
what the form does.

## Upload sizes

| Upload | Limit | Set by |
|---|---|---|
| Image creative file (also native images, VAST companion images) | **200 KB** per file by default | Network preference *Max allowed file size* — the error message states the current cap. HTML5 ZIPs are not checked against it; they have the archive limits below |
| Video creative file | **20 MB** per file by default | Network preference *Max allowed video file size* |
| Media library file | Image and video: the same two caps as a creative file. An HTML5 archive is not size-checked here, only unpacked under the limits below | The same preferences |
| White-label images (logo, favicon, sign-in background) | **none** | Format and pixel dimensions are checked, size is not — see below |
| Any multipart upload | **1 GB** per file *and* 1 GB per request | Platform-wide, not per-network |
| File named by URL over the API (`imageFileUrl`, `videoFileUrl`, `fileUrl`…) | the video limit for a linked video; at least 10 MB for a linked image or template file (HTML5 ZIP: 10 MB); never more than 100 MB. A hosted copy is held to the image or video limit exactly | Follows the two preferences; the rest is fixed. The per-file caps above still apply once it is downloaded |
| HTML5 archive, unpacked | 1000 files, 20 MB per file, 50 MB in all | Configurable by Epom |

Over-size creatives are refused with **"File is bigger than 200 KB"** — the message quotes the
network's current cap (in whole KB for an image, whole MB for a video, rounded down), so it is the
quickest way to read the effective value.

> **Corner case:** the two creative preferences apply exactly as stored, whole numbers from 1 byte
> to 2 147 483 647. They are not floored at the 200 KB and 20 MB defaults, so lowering either one
> (ask Epom support or your account manager) tightens uploads, the ad servers picking the new value up within a minute.

> **Corner case:** the creative cap is checked per uploaded file, so a banner carrying two files
> checks each against it separately. The 1 GB ceiling additionally applies to the whole request.

### White-label images

No byte limit at all. What is checked instead:

| Check | Rule |
|---|---|
| Format matches the slot | `.svg` slots take SVG only, `.ico` slots take ICO only, everything else takes PNG |
| Dimensions | must equal the dimensions of the shipped default for that slot |
| SVG exception | any size up to **500 px** wide |
| ICO exception | up to **500 px** wide and square |
| Free-size slot | `login-bg.png` is exempt from the dimension check entirely |

## Native creative text lengths

Configurable by Epom, but only **downwards** for the first three: 255 characters is their ceiling
whatever the setting says.

| Field | Default max | Ceiling |
|---|---|---|
| Title | 255 | 255 |
| Subtitle | 255 | 255 |
| Call to action | 255 | 255 |
| Description | 32 000 | the configured value |

## Field lengths

Maximum length in characters.

| Entity | Field | Limit |
|---|---|---|
| Advertiser | Name | **128** |
| Advertiser | Contact name | **64** |
| Advertiser | Contact email | **64** |
| Advertiser | Brand domain (`adomain`) | **255** |
| Campaign | Name | **512** |
| Campaign | Alias for action tracking | **64** |
| Banner | Name | **1–512** — must not be empty |
| Banner | Ad code (HTML/JS creative body) | **100 000** |
| Banner | Click-through URL | **4 000** |
| Banner | Image file link / video file link | **1 023** each |
| Banner | Title | **128** |
| Banner | ISCI / Ad-ID code | **64** |
| Banner | ISCI / Ad-ID registry | **64** |
| Site | Name | **128** |
| Site | URL | **255** |
| Site | App bundle id | **255** |
| Site | Contact email | **64** |
| Site | Seller id (sellers.json) | **64** |
| Site | Invocation-code host | **64** |
| Zone | Name | **128** |
| Placement | Name | **512** |
| Placement | Custom OpenRTB tag ID | **256** |
| Banner template | Title | **1–255** — must not be empty |
| User | Email | **64** |
| User | Password | **8–64**, configurable by Epom |
| User | First name, last name, company, website URL, state | **64** each |
| User | Phone | **20** — digits, spaces and `+ ( ) -` only |
| User | Country code | **2** (ISO 3166-1 alpha-2) |

## Numeric ranges

| Input | Range | Notes |
|---|---|---|
| Banner weight | 1 – 32 767 | |
| Campaign weight | 0 – 32 767 | |
| Capping amount | 0 – 8 388 607 | Checked on every capping save. The Add dialog lets you type 100 000 |
| Capping period | 1 – 255 | Same. The Add dialog lets you type 0 and 100 000, both of which the server refuses |
| Limits — impressions, clicks, conversions, opportunities, requests | 0 – 4 000 000 000 per cell | Whole numbers |
| Limits — budget | 0 – 9 999 999 999.999 per cell | Up to three decimal places |
| No-conversions hours / no-conversions impressions | 0 – 4 000 000 000 | |
| Advertiser self-serve CPM floor adjustment | 0 – 10 000 | 100 = no adjustment |
| Placement rotation interval | 0 – 1 000 seconds | 0 = no rotation |
| Placement refresh interval | 0 – 1 000 seconds | 0 = no refresh |
| Placement third-party network lookup limit (daisy chaining) | 0 – 10 | Default 5. The placement form no longer shows the field; the REST API still accepts it |
| Daisy chaining lookup depth | 1 – 100 | Named in the field error |
| Daisy chaining views per entity, rotating count | 1 – 10 000 000 each | Same |
| Advertiser preliminary confirmation days | 0 – 365 | Default 1 |
| Campaign exchange rate | 0.001 – 999.999 | |
| Header-bidding tag bid timeout | 100 – 65 535 ms | Default 1 000 |
| Header-bidding tag refresh interval | 0 – 65 535 seconds | 0 = no refresh |
| Header-bidding tag refresh idle minutes | 0 and up, no maximum | |
| Campaign burn-up period | 0 and up, no maximum | |
| Campaign estimated CTR | 0 – 1 | A fraction, not a percentage — 0.005 means 0.5%. Kept to four decimal places; more are rounded |
| Campaign estimated conversion rate | 0 – 1 | A fraction, as above — 0.002 means 0.2%. Kept to six decimal places; more are rounded |
| Price — campaign, placement and site pricing, Global and per country | 0 – 1 000 000 | Kept to six decimal places |
| Bid floor — site, placement and banner, Global and per country | 0 – 1 000 000 | Kept to six decimal places |

> **Corner case:** a price or bid floor outside 0 – 1 000 000 is refused on save with a message
> naming the field and the limit; more than six decimal places is accepted and stored rounded to
> six.

> **Corner case — a limit of `0` means "no limit", not "stop".** Every limit and every capping
> amount is skipped when it is 0. Typing 0 to halt delivery does the opposite of what it looks
> like; deactivate the entity instead.

## Sign-in and password throttling

Repeated failed sign-ins — on the login form, `POST /rest-api/auth/token.do`, or API calls with a
wrong `hash` or API key — temporarily block further attempts. The refusal says how long to wait;
wait for that, or ask your network manager.

> **Note:** if your users sign in through a CDN or proxy of your own, tell Epom support or your account manager, so that
> users behind it are not counted as one address. The same address is what per-user IP
> whitelists compare against.

Password rules and the reset flow have their own set:

| Limit | Default | Notes |
|---|---|---|
| Password length | 8 – 64 characters | The floor follows NIST SP 800-63B |
| Password similar to the username or email | rejected | Epom can switch the check off |
| Password on the common-password blocklist | rejected | Epom can switch the check off |
| Forgot-password link lifetime | 60 minutes | |
| Initial set-password link lifetime (new user) | 72 hours | |
| Password reset requests and link redemptions | Rate-limited | Per email address and per source address |

## Pagination

Grids and list endpoints default to **50 rows per page**. Request larger pages sparingly — a very
large page makes the response slow.

## Where no limit exists

These have no numeric cap of their own; each is bounded only by what is noted.

| Area | Status |
|---|---|
| Analytics API | The analytics report is metered: a *Daily requests per user limit* (default 100) and a *Records per request limit* (default 10,000), both network settings Epom support changes on request — see [API quotas](https://epom.com/ad-server/docs/api.md#api-quotas-how-many-requests-can-i-make-per-day) |
| Report date ranges | Not numerically capped. Preset ranges are permission-gated per role; a long Advanced or raw-log range is bounded by job runtime |
| Entity quotas — campaigns per advertiser, banners per campaign, and so on | None |
| White-label image byte size | None — bounded by dimensions and by the 1 GB ceiling |
| CSV / bulk uploads — preset groups, country pricing | No row-count or file-size cap beyond the 1 GB ceiling |
| Scheduled-report recipients | No count cap. The whole list is held as one text of about 65 000 characters, which is the practical bound. Addresses are not validated on the way in |

## Related

- [Capping matrix](https://epom.com/ad-server/docs/reference/capping-matrix.md)
- [Limits](https://epom.com/ad-server/docs/guides/delivery/limits.md)
- [Banner types](https://epom.com/ad-server/docs/reference/banner-types.md)
- [Users and roles](https://epom.com/ad-server/docs/guides/admin/users-and-roles.md)