coss.comdocs

Update a rate limit bucket

PATCH
/v1/risk/limit_buckets/{id}

Changes the fields given; the next check uses them. Keys keep what they spent, so a smaller bucket can deny a key until it refills.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Path Parameters

id*string

The bucket's id.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
limit?integer
Range1 <= value <= 1000000
period_seconds?integer
Range1 <= value <= 86400
burst?integer
Range1 <= value <= 1000000
on_failure?string
Value in"allow""deny"

Response Body

The bucket, updated.

application/json
  1. response
object*"risk_limit_bucket"
Value in"risk_limit_bucket"
id*string
name*string

What POST /v1/risk/limits names it by.

limit*integer

Tokens added per period_seconds.

period_seconds*integer
burst*integer

The bucket's size: how many requests a key can make at once.

on_failure*string

The answer while COSS can't count (its store is unavailable): allow (fail open) or deny.

Value in"allow""deny"
created_at*string
Formatdate-time
updated_at*string
Formatdate-time
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.risk.limitBuckets.update("rsklb_01k7c8m4q2f3e9v6t5r1n0p8yz", {  limit: 10,  burst: 20,});
{  "object": "risk_limit_bucket",  "id": "rsklb_01k7c8m4q2f3e9v6t5r1n0p8yz",  "name": "password_reset",  "limit": 5,  "period_seconds": 3600,  "burst": 5,  "on_failure": "allow",  "created_at": "2026-01-15T09:30:00.000Z",  "updated_at": "2026-01-15T09:30:00.000Z"}