# Errors, Rate Limits & Credits

Requests are metered two ways - how fast you call, and how many credits you spend.

## Request rate

Requests are rate-limited per token, about **1 request per second**. Sending faster returns `429` with the `X-RateLimit-Reason: rate_limit` header.

## Credits

- Every request costs **1 credit** - including a request that returns 0 records and a request on a `pending` domain.
- The Non-Human Identities (NHI) API has its own credit balance, separate from the Data Breaches API. `requestsLeft` in every response shows what remains.
- When credits run out, requests return `429` with the `X-RateLimit-Reason: insufficient_credits` header.

## Domains

Any valid registered domain can be queried; the first query starts monitoring it (see [Response Format](nhi-response-format)). If Webz.io cannot take on a new domain at the moment, the request returns `503` - existing domains are unaffected.

## Error responses

Errors return `{ "errorCode": <code>, "errors": ["message", ...] }`.

| Status | When |
| --- | --- |
| `400` | Missing, unknown, duplicated, or malformed parameter; a `domain` that is not a valid registered domain; or an invalid `next` cursor. |
| `401` | Missing or invalid token, or your account lacks the Non-Human Identities (NHI) API permission. |
| `402` | Account email is not verified. |
| `404` | Endpoint not found, or no user for the token. |
| `429` | Rate limit exceeded, or insufficient credits (see `X-RateLimit-Reason`). |
| `500` | Internal error. |
| `503` | Service temporarily unavailable, or no capacity to monitor a new domain right now. |

> [!TIP]
> Need access or more credits? Contact **sales@webz.io**.