Felt
DATA · DATA & ANALYTICS
Maps, layers, layer groups, elements, comments, and projects in the workspace they connected.
Connecting Felt in practice
Felt throttles by IP address — currently 300 requests per minute — rather than by token, so two agents behind the same egress address share one budget, and a 429 means either that or the workspace’s plan quota depending on whether `x-api-limit-exceeded` is false or true. Tokens are workspace-scoped, carry their creator’s permissions, and never expire until revoked.
Scopes that draw scrutiny
felt_pat_… tokenFelt documents no granular scopes: a token "acts with the creator’s account permissions" and can only reach the workspace it was created in, so narrowing access means creating it as a narrower user.
Rate limits
- A per-IP request throttle, currently 300 requests per minute per IP address.
- A separate per-plan usage limit for the workspace.
- 429 with code `too_many_requests`; the `x-api-limit-exceeded` header is false when the IP throttle tripped and true when the plan usage limit did.
- Uploads are accepted up to a limit of 5 GB, for both files and hosted URLs.
Worth knowing
- Because the throttle is per IP, an agent platform sharing one NAT address with other traffic can be rate-limited by activity it cannot see — and `x-api-limit-exceeded` is the only way to tell that apart from a quota breach.
- Uploading is two calls plus an out-of-band step: request a presigned S3 URL, upload to Amazon S3, then poll the layer until `status` reaches completed, because "a layer must reach completed before it can be styled or refreshed".
- Layer status is one of uploading, processing, completed or failed with `progress` from 0 to 100, so an agent has to model the job rather than assume the write succeeded.
- Tokens have no expiry, so rotation is a create-then-revoke exercise the workspace has to run itself.
Checked against Felt errors and rate limits (2026-09-29), Felt authentication (2026-09-29), Felt uploading files and URLs (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Felt behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.