Rate limits

The limits

Rate limits apply per API key, and today only to the free-tool endpoints:

These reflect current behavior, not a contractual SLA — they can tighten as the platform grows. If you’re building something high-volume, design for limits even where none apply yet.

When you hit a limit

An over-limit request returns 429 Too Many Requests with the standard error envelope:

{ "error": { "code": "…", "message": "…", "status": 429 } }

Back off and retry after a short pause. For the async scans (tech-stack, trust-signals, agent-adoption), poll the get endpoint every 2–5 seconds — that stays well under the limit and matches how long a scan takes.

Next steps

• Authentication → — keys and auth errors.
• API Reference → — per-endpoint details.