Limits

What Mast counts, what each plan allows, and what happens at the edges: a sender that posts too fast, a key that turns up in a public commit, a probe pointed at a name that no longer exists, and a card that stops going through.

Channels and keys

Every channel has one live key, the secret part of its send URL. Rotating a key issues a new one and leaves the old one working for seven days, so for that week the channel holds two.

Vitals don't count as channels, but each vital's key counts as a key.

If you bought the Mast Pager app, you get at least 10 vitals, 25 channels and 100 keys whatever plan the account is on, and the same without an account at all.

Archived channels don't count. Keys count while they can still send: the live one, and an old one inside its seven-day overlap.

At a cap, creating a channel (or un-archiving one) answers 402 with code plan_limit, and the message names the cap and the plan:

{
  "error": {
    "code": "plan_limit",
    "message": "The Free plan allows 10 channels and this account has 10. Nothing was deleted; remove one or upgrade to add more.",
    "limit": 10,
    "used": 10,
    "plan": "Free"
  }
}

Rotating is never refused. At the key cap, a rotation retires the old key on the spot instead of giving it the seven-day overlap, and the response carries "grace_skipped": "key_cap" so a script can tell. Update the sender straight away in that case.

After a downgrade

Moving to a plan with lower caps deletes nothing, and the things past a cap stop until you move back up. Within the hour, the newest channels, vitals, keys, probes, rotations, policies and status pages beyond the new plan's numbers are paused; the oldest ones keep working. A send to a paused channel or key answers 403 with code over_cap, a paused vital is not watched, a paused probe stops checking, a probe set to check more often than the new plan allows is checked at the plan's shortest interval until you move back up, a paused rotation or policy is not followed, and a paused status page answers 404. New ones are refused until you are under the cap. The account owner gets one page saying what the account holds against the new plan's numbers, and everything paused resumes within the hour of the account being under the cap again or the plan moving back up. The billing page has the rest.

Messages and history

The monthly number is a fair-use line, not a gate. Every accepted send counts against it, and Usage in the web app shows the count and where the month is heading, but a send past the line is not refused: a pager that drops a page over a quota has failed at the one thing it is for. If you are past the line every month, the next plan up is the one for you.

History is how long a message stays in the feed, the API and the web app. Past it the message is deleted, and a card the server no longer holds opens as aged out of retention, or deleted. If you bought the Mast Pager app, you keep 30 days whatever plan the account is on.

Destinations

Destinations need a Tissue Mast account. A phone with no account can't add any.

Free can save Slack, Discord, Teams and email destinations. A signed webhook destination, and callback= on a send, start at Solo. A callback= the plan doesn't include is dropped with a warning in the 202, and the page still goes through. Adding a destination past the cap, or a webhook on Free, answers 402 plan_limit.

The callback URL a send carries doesn't count as a destination.

Maintenance windows

A scheduled or weekly window on Free answers 402 plan_limit. The 101st window answers 409 too_many_windows. Maintenance windows has the rest.

Domain expiry notices

Solo, Team and Company watch the registration of the domain behind each probe and send a notice 30, 14 and 7 days before it lapses. Free doesn't. Setting domain_expiry: true on a probe on Free answers 402 plan_limit. Probes has the rest.

Path traces

Solo, Team and Company trace the route to a probe's target when a location's check fails, and the page for a confirmed down says where the path stopped answering. Free doesn't, and GET /v1/mast/probes/{id}/traces on Free answers 402 plan_limit. A location traces each probe at most once every ten minutes. A plan change usually reaches the probes on their next check, and always within the hour. Probes has the rest.

Status pages on your own domain

Solo, Team and Company can serve a status page on a subdomain of their own. Free can't: setting custom_domain on Free answers 402 plan_limit. A verified domain on an account that moves down to Free stops being served within a few minutes, and starts again when the plan moves back up. Status pages has the rest.

How fast you can send

Each channel key takes 60 sends a minute, and one owner takes 600 a minute across all their keys. Past either, the send answers 429 Too Many Requests with Retry-After: 1.

On a vital, an over-limit send still counts as a beat. The vital's last-beat time moves (at most once every 15 seconds) and the body is dropped, so a job stuck in a tight loop is shown as alive, not as a flatline. The answer says so:

{
  "error": {
    "code": "rate_limited",
    "message": "Too many sends to this channel. The beat was counted and the body dropped.",
    "counted": true,
    "body_dropped": true
  }
}

On an ordinary channel an over-limit send is dropped and the answer has no counted field.

A key in a public commit

Mast keys have a fixed shape, mk_ and 40 hex characters, and GitHub's secret scanning looks for it in public repositories. When GitHub reports one of your keys, Mast:

1. revokes it at once, with no seven-day overlap,
2. issues the channel a new key,
3. pages you on that channel: "One of your Mast keys was found in a public commit at url. It has been rotated; update the sender."

Nothing is paused and nothing else changes. The channel keeps paging with its new key, which the app shows the next time it syncs. Anything still posting the old key gets 404 until you give it the new URL.

A key that was already revoked when it turned up is left alone.

Probes that pause themselves

A probe pauses on its own in two cases. Either way the reason shows on the probe, and resuming it from the dashboard starts it checking again.

The target is gone. If every check for 7 days fails because the name doesn't resolve or there is no route to it, the probe pauses as unreachable and the account owner gets one email. A target that answers with an error, times out or refuses the connection is down, not gone, and keeps being checked and paged. A DNS probe whose name comes back NXDOMAIN is down too, since a missing record is what it's there to catch, and it isn't paused for it.

Nobody signs in. An account with no sign-in for 83 days gets an email saying its probes pause in 7 days. At 90 days, and never less than 7 days after that email, the probes pause as inactive and a second email says so. Signing in resumes them within the hour. Where an account has never signed in on the web, its last API token use stands in for a sign-in, and the email says which one it went by.

Vitals and channels aren't affected by either.

When the card fails

A declined renewal changes nothing for 14 days. After 14 days past due:

• escalation stops after the first page: the page to you goes out, and the steps that would hand it to someone else don't,
• probes pause, with the reason billing.

The pager keeps paging. Every send to a channel you own, and every vital's page to you, reaches your phone the whole time. When the card goes through, escalation comes back and the probes resume within the hour. Nothing is deleted. Billing has the rest.