Error format
The API sends each error as a problem details object (RFC 9457) with the media typeapplication/problem+json.
Some errors add more fields. For example,
missing-entitlement adds add_on_code.
Error slugs
Validation errors
When a query parameter is not valid, the API answers422 with the slug validation-failed. The errors list names each parameter and the problem.
Request ID
Each response has anX-Request-Id header. Its value is the same as correlation_id in an error response. When you contact support about a request, give this ID.
You can send your own X-Request-Id header. The value can have 1 to 128 letters, digits, ., _ or -. The API then uses your value.
Rate limit
Each API key can send 600 requests in a window of 60 seconds. The window starts with the first request of the key. When a key sends more requests, the API answers429 with the slug usage-limit. The response has no Retry-After header.
1
Stop the requests
When you get
429, stop sending requests with this key.2
Wait
Wait 60 seconds. The window then starts again.
3
Send the request again
Send the request again. If you get
429 again, wait longer before the next try.Pagination
Endpoints that return long lists send the list one page at a time. These endpoints accept two query parameters:
The response holds the items of the page and these fields:
The name of the list depends on the endpoint, for example
rows, findings or pages. The Endpoints reference shows the name for each endpoint.
page=1. Increase page by one until page is equal to total_pages. For an endpoint without total_pages, stop when the items of all pages reach total.

