Limits & troubleshooting
Limits & troubleshooting
Request limits
| Resource | Documented limit |
|---|---|
| Template | 10 MiB |
| Generated output / conversion input | 25 MiB |
| HTTP request body | 36 MiB |
| OOXML package entries | 2,048 |
| Total decompressed OOXML content | 100 MiB |
| Image and imported DOCX attachments | 10 MiB and 128 attachments in total per generation |
| Supplied filename | 128 safe ASCII characters |
| Tenant request rate | 60 requests per minute per API instance |
| Process concurrency | Four |
Replacement nesting, rows, field counts, and text lengths are also bounded. Public demos and the Power Platform connector have additional restrictions. These per-instance limits are not distributed quotas or throughput guarantees.
HTTP errors
| Status | Meaning | What to check |
|---|---|---|
400 |
Invalid request or typed value | JSON shape, field kind, and matching value property |
401 |
Authentication failed | Correct API origin and complete, active credential |
403 |
Missing permission or inactive entitlement | API audience/scopes, tenant, and licensing |
413 |
Size limit exceeded | Decoded input, HTTP body, and package expansion |
422 |
Invalid/unsafe template or unsupported operation | Actual format, unsupported fields, active content, output combination |
429 |
Rate/concurrency limit, renderer busy, or exhausted credits | Response details and credit/reset headers before retrying |
503 |
Renderer, licensing, or another required dependency unavailable | Deployment capability and operator configuration |
504 |
Render timeout | Template complexity and renderer health |
500 |
Unexpected processing error | Safe error code and trace ID for support |
Processing failures use Problem Details with a stable code and traceId, not a partial document or internal exception details.
A field did not change
- Inspect the exact template you sent for generation.
- Match spelling, qualified name, and parent group from inspection.
- Check the field’s
supportedflag. - Supply only the typed value property for its kind, such as
text,number,boolean,date, orrows. - Check the missing-field policy and response warnings.
Field counts describe template occurrences, not necessarily unique names. Repeating replacements can increase replacement counts.
PDF output is unavailable
Check /api/v1/capabilities. Word/Excel-to-PDF requires a separate enabled and available renderer; Office preview settings do not provide it. Enabled configuration is not a runtime health guarantee. Use native output while your operator diagnoses the renderer.
For stale PDF form appearances, test another viewer. DocLab requests viewer-generated appearances but does not flatten forms.
A key or workspace connection fails
Use the target API’s origin and your complete current key, not its public prefix, stored hash, server-to-server secret, or a Microsoft ID token. Hosted self-service keys require the target API’s licensing validator; they are not automatically local configuration keys.
For a browser CORS failure, your operator must allow the exact frontend origin in applicable platform and application policies. Inspect the API URL and response status without copying authorization headers. See authentication.
An Office preview fails
Check /api/v1/previews/capabilities, explicit sharing consent, and whether Microsoft’s servers can reach the preview HTTPS origin. Links expire and are lost on API restart. Download-only is the fallback. See preview privacy.
Rejected content and production readiness
Macros, embedded objects, external images, linked templates/workbooks, file/javascript hyperlinks, and unsafe resources are rejected. Rendering also rejects Word DDE and linked-resource field instructions.
The documented implementation still has production gates, including worker isolation, PDF active-content filtering, distributed quotas, retention, dependency/license review, and real-provider authentication/customer-template testing. Do not infer certifications, complete sanitization, or unlimited scale from the presence of these checks.
Contact support safely
Include the operation, timestamp, HTTP status, safe error code, and trace ID. Describe the format and whether the issue affects inspection, generation, conversion, or preview.
Do not include API keys, bearer tokens, preview URLs, request headers, or customer document contents. Arrange an approved secure channel before sharing a sanitized reproduction template.