Errors, Rate Limits & Credits

Requests are metered two ways - how fast you call, and how many credits you spend.

Request rate

Requests are rate-limited per token, about 1 request per second. Sending faster returns 429 with the X-RateLimit-Reason: rate_limit header.

Credits

• Every request costs 1 credit - including a request that returns 0 records and a request on a pending domain.
• The Non-Human Identities (NHI) API has its own credit balance, separate from the Data Breaches API. requestsLeft in every response shows what remains.
• When credits run out, requests return 429 with the X-RateLimit-Reason: insufficient_credits header.

Domains

Any valid registered domain can be queried; the first query starts monitoring it (see Response Format). If Webz.io cannot take on a new domain at the moment, the request returns 503 - existing domains are unaffected.

Error responses

Errors return { "errorCode": <code>, "errors": ["message", ...] }.

Status	When
400	Missing, unknown, duplicated, or malformed parameter; a domain that is not a valid registered domain; or an invalid next cursor.
401	Missing or invalid token, or your account lacks the Non-Human Identities (NHI) API permission.
402	Account email is not verified.
404	Endpoint not found, or no user for the token.
429	Rate limit exceeded, or insufficient credits (see X-RateLimit-Reason).
500	Internal error.
503	Service temporarily unavailable, or no capacity to monitor a new domain right now.