Per-Identifier Overrides

One identifier, its own limit. No extra rule.

Give a specific user, key, or IP a different limit than the rule default. The override shares the rule counter and inherits whatever you leave unset — only the limit is required.

Scope

identifier

Counter

shared

Inherit

unset fields

Required

limit only

Read the docs See pricing

Control

Per-Identifier Overrides

One identifier, its own limit. No extra rule.

live · schematicControl

Scopeidentifier

Countershared

Documentation

Rules set the default. Overrides set the exception. When one user, key, or IP needs a different limit than everyone else, you add an override to the rule — not a second rule, not a code branch, not a special case in your middleware.

How it works

An override binds an identifier to a new limit on an existing rule. It shares the rule's counter and inherits everything you leave unset — window, burst, refill rate. Only the limit is required.

Snippet

curl -X POST https://api.brume.run/v1/ratelimit/rules/$RULE_ID/overrides \
  -H "Authorization: Bearer $BRUME_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "identifier": "user_9x2", "limit": 1000 }'

user_9x now gets 1,000 requests per window under the api rule while everyone else keeps the rule's default. The override is resolved inside the same atomic Lua evaluation as the rule — no extra round trip, no second lookup.

What you can override

Field	Required	Meaning
`identifier`	yes	The exact identifier this override applies to
`limit`	yes	The override's limit
`window_seconds`	no	Inherited from the rule when omitted
`burst`	no	Token bucket only; inherited when omitted
`refill_rate`	no	Token bucket only; inherited when omitted

Typical uses

Paying customers get a higher ceiling than free users, keyed by user ID.
Internal services calling your API get headroom that external traffic doesn't.
A misbehaving integration gets a tighter leash while you work with its owner.

Managing overrides

GET /v1/ratelimit/rules/:rule_id/overrides — list a rule's overrides
POST /v1/ratelimit/rules/:rule_id/overrides — create
DELETE /v1/ratelimit/overrides/:id — remove

Overrides require the manage_project scope and count against your tier's per-rule override cap. When the cap is reached, new overrides are rejected with PLAN_LIMIT (rate_limit_overrides_cap_reached).