Errors, Rate Limits & Credits

Requests are metered two ways - how fast you call, and how many credits you spend.

Request rate

Requests are rate-limited per token, about 1 request per second. Sending faster returns 429 with the X-RateLimit-Reason: rate_limit header.

Credits

• Every request costs 1 credit - including a request that returns 0 records and a request on a pending domain.
• The Leaked Cookies API has its own credit balance, separate from the Data Breaches API. requestsLeft in every response shows what remains.
• When credits run out, requests return 429 with the X-RateLimit-Reason: insufficient_credits header.

Domains

Any valid registered domain can be queried; the first query starts monitoring it (see Response Format). If Webz.io cannot take on a new domain at the moment, the request returns 503 - existing domains are unaffected.

Error responses

Errors return { "errorCode": <code>, "errors": ["message", ...] }.

Status	When
400	Missing, unknown, duplicated, or malformed parameter; a domain that is not a valid registered domain; or an invalid next cursor.
401	Missing or invalid token, or your account lacks the Leaked Cookies API permission.
402	Account email is not verified.
404	Endpoint not found, or no user for the token.
429	Rate limit exceeded, or insufficient credits (see X-RateLimit-Reason).
500	Internal error.
503	Service temporarily unavailable, or no capacity to monitor a new domain right now.