Scopes, limits, usage
A key's scope is its licence made executable: the server enforces it on every request. Rate limits and daily quotas keep serving fair; usage counters show what you consumed.
Scopes
A key is scoped to the full catalog or to a set of verticals. Enforcement is server-side on every request:
- A request naming a vertical outside the licence returns 403 with the detail outside this key's licensed scope.
- A key whose organisation has no active plan returns 403 with the detail billing_required. Restore the plan to resume access; the key itself is unchanged.
- A key licensed for one vertical has it applied automatically when the request names none.
- A key licensed for several verticals must name which one it wants per request (the readers filter one vertical at a time); leaving it off returns 400 listing your options.
- Profile endpoints filter their payloads to the licensed slice before anything is serialized, and cross-catalog blocks are omitted on scoped keys.
Rate limits
Each key gets 120 requests per minute and 10,000 requests per day on the standard tier. Limits are per key: one busy key never slows a sibling key. Both refusals carry the same headers:
HTTP/1.1 429 Too Many Requests
Retry-After: 21
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 21
{"detail": "rate limit exceeded for this key"}The minute limit resets on a sliding window; X-RateLimit-Reset counts the seconds until room opens. The daily quota resets at midnight UTC, and its refusal says daily quota exceeded for this key so the two are distinguishable in logs. Back off on 429; a 401 is terminal, see Authentication and keys.
The page cap
Every list endpoint caps its page size (500 rows for the events ledger, 200 for signals) regardless of what the request asks for. Asking for 10,000 rows returns one capped page plus a cursor or offset to continue. This is deliberate: the API serves the corpus page by page, with receipts, and has no bulk-export mode.
Usage counters
Every served request increments a per-day, per-endpoint-family counter for its key. Admins read them on the Organisation tab in Settings per key: a day-by-day table and totals by family. The counters are the shared usage record for the licence. They count requests only; they carry no request content.