Using the API
Rate limits
How many requests and scans each plan allows.
Limits are per key and depend on the plan of the account that owns it.
| Plan | Requests a minute | Requests a day | Scans a day |
|---|---|---|---|
| Free | 10 | 100 | 5 |
| Starter | 60 | 1,000 | 25 |
| Pro | 300 | 10,000 | 100 |
| Agency | 1,000 | 100,000 | 500 |
| Enterprise | 2,000 | Unlimited | 2,000 |
Days are UTC days. Audits also count towards your plan's monthly audits and concurrent audits, as they do in the app; GET /info shows your limits and how much you've used (an unlimited one is -1).
Headers
Every response to a request with a key carries:
X-RateLimit-Limit: requests allowed a minuteX-RateLimit-Remaining: requests left this minuteX-RateLimit-Reset: when the minute's count resets, in Unix seconds
Over the limit, you get 429 with the code rate_limited (or rate_limited_daily), and a Retry-After header in seconds.
Staying inside them
Poll gently. Checking an audit every 10 to 30 seconds is plenty: most take a few minutes.
Use one key per integration, so one busy job can't use up another's minute.
Back off on 429. Wait for
Retry-After, then try again.