Defaults
Higher limits are available for partners with volume requirements — contact your account manager.
Response headers
Every authenticated response includes:Limit— requests allowed in the current window.Remaining— requests left before you hit the cap.Reset— seconds until the window resets.
429 response
When you exceed the limit:reset_seconds before retrying. Exponential backoff is a reasonable default if you’re running uncoordinated workers.
Batch endpoints
Rate limits apply to HTTP requests, not to the number of targets inside a batch. Submitting one batch of 500 domains counts as one request. Batches are processed server-side with internal concurrency controls (~10 targets in flight) — submitting 10 consecutive batches still results in serial processing.Credits vs. rate limits
These are independent gates. A request can fail with 402 (insufficient credits) even when you’re far below your rate limit, and vice versa. Check balance at/v1/scanner/credits/balance before high-cost operations.