Plans & Quotas
Vyntech Account offers three plans — Free, Pro, and Enterprise. Each plan defines quotas (max users, roles, API keys, policies) and feature availability (risk engine, webhooks, custom branding, IP access control). This guide explains the plan structure, how quotas are enforced, and how to handle limit errors.
Plan Overview
The table below compares all three plans across quotas and feature availability. A value of -1 in the API means unlimited.
| Quota / Feature | Free | Pro | Enterprise |
|---|---|---|---|
| Quotas | |||
| Max Users | 50 | 500 | Unlimited |
| Max Roles | 5 | 25 | Unlimited |
| Max API Keys | 2 | 20 | Unlimited |
| Max Policies | 3 | 50 | Unlimited |
| Features | |||
| MFA (TOTP) | ✓ | ✓ | ✓ |
| Risk Engine | — | ✓ | ✓ |
| Custom Branding | — | ✓ | ✓ |
| Webhooks | — | ✓ | ✓ |
| IP Access Control | — | ✓ | ✓ |
| Custom Sender Domain | — | — | ✓ |
| Dedicated Support | — | — | ✓ |
Checking Current Plan
Every tenant has a planfield that indicates which tier they're on. Retrieve the tenant to check the current plan.
/api/v1/tenants/:id🔒 AuthRetrieve tenant details including the current plan.
Retrieving Plan Details
Fetch all available plans with their quotas and feature flags. Use this to display plan comparisons in your UI or to programmatically check limits before creating resources.
/api/v1/plans🔒 AuthList all plans with their quotas and feature availability.
Quota Enforcement
Quotas are enforced at creation time. When a tenant attempts to exceed a limit — for example, creating user #51 on the Free plan — the API returns 402 Payment Required with a message indicating which quota was hit and the current plan.
Existing resources are never deleted or disabled when a quota is reached. The tenant simply cannot create new resources of that type until they upgrade or delete existing ones.
Why 402? We use 402 Payment Required instead of 403 because the action would succeed if the tenant upgraded their plan. This makes it easy to distinguish quota errors from permission errors in your error handling logic.
Example: Quota Exceeded Response
When POST /api/v1/users is called on a Free plan tenant that already has 50 users:
{
"error": "quota_exceeded",
"message": "User limit reached. Your plan (free) allows a maximum of 50 users.",
"quota": "max_users",
"limit": 50,
"current": 50,
"plan": "free",
"upgrade_url": "https://id.vyntech.com.au/billing/upgrade"
}Feature Gating
Features not available on a tenant's plan return 403 Forbidden with a message indicating the feature requires a higher plan. This is distinct from permission-based 403s — the error body includes a feature_required field.
For example, calling PATCH /api/v1/settings with a risk_engine configuration on a Free plan tenant:
{
"error": "feature_not_available",
"message": "The risk_engine feature is not available on your plan (free). Upgrade to Pro or Enterprise to access this feature.",
"feature_required": "risk_engine",
"plan": "free",
"minimum_plan": "pro",
"upgrade_url": "https://id.vyntech.com.au/billing/upgrade"
}Distinguishing 403 types: Check the error field — feature_not_available means a plan upgrade is needed, while forbidden means the user lacks the required permission (e.g., missing settings:write role).
Upgrading Plans
Plan changes are managed via the admin panel or by contacting sales. The API does not allow self-service plan changes — this prevents abuse and ensures billing coordination.
- •Immediate effect: When a tenant is upgraded, new limits and features apply immediately. No restart or re-authentication required.
- •No data loss on downgrade: If a tenant is downgraded (e.g., Pro → Free), existing resources are never deleted. However, new creation is blocked until the tenant is within the new plan's limits.
- •Feature disablement: Features not available on the new plan (e.g., risk engine on Free) stop being enforced but configuration is preserved. Re-upgrading restores previous settings.
Enterprise upgrades: Contact sales@vyntech.com.au for Enterprise plan pricing. Enterprise includes custom quotas, SLA guarantees, dedicated support, and custom sender domain configuration.
Handling Quota Errors in Your App
Your application should gracefully handle 402responses by detecting the quota error and showing an upgrade prompt instead of a generic error message. Here's a pattern for each language:
/api/v1/users🔒 AuthExample: creating a user with quota error handling.
Best Practices
Check quotas before showing "Create" buttons
Fetch the tenant's plan limits via GET /api/v1/plansand compare against current usage. Disable create buttons or show upgrade prompts when the tenant is at capacity — don't wait for the API to reject the request.
Handle 402 gracefully
Show a clear upgrade prompt with the specific limit that was hit, not a generic "something went wrong" error. Include the upgrade_url from the response to direct users to the billing page.
Monitor usage via tenant stats
Use the tenant details endpoint to track resource counts. Set up alerts when a tenant reaches 80% of any quota — proactively suggest upgrades before they hit a wall.
Plan capacity for enterprise onboarding
Before onboarding large customers, ensure their tenant is on the Enterprise plan. Bulk user imports on a Free or Pro plan will fail partway through when quotas are hit, leaving partial data that needs cleanup.