Limits and paging
Request budgets
Each API key, and each OAuth connection, may send per minute:
| Requests | Per minute |
|---|---|
Reads (GET) | 120 |
| Writes (everything else) | 60 |
Every answer carries the budget:
| Header | Meaning |
|---|---|
RateLimit-Limit | Requests of this kind allowed per minute |
RateLimit-Remaining | Requests left this minute |
RateLimit-Reset | Seconds until the budget resets |
Past the budget the API answers 429 with the code RATE_LIMITED and a Retry-After header: wait that many seconds. Independently, each IP address may send 10 requests a second (bursts of 20).
Heavy operations
A few operations also have a budget per workspace, whoever calls:
| Operation | Limit |
|---|---|
| The outside view of an asset | 120 a minute |
| Run discovery | 10 an hour |
| Check an asset again | 30 an hour |
| Create an assessment report | 10 an hour |
| Export the audit log | 10 an hour |
Your plan's limits apply as in the dashboard: on-demand scans have daily limits per asset and per workspace (403 LIMIT_REACHED), and an asset past your plan's included ones needs a paid slot, which only the dashboard can buy (403 EXTRA_PURCHASE_NOT_ALLOWED).
Paging
Lists come in pages. Send page (from 1) and limit (rows per page: 100 when you send none, at most 500):
curl "https://api.fortwatch.ai/app/scans?page=2&limit=200" -H "Authorization: Bearer $FORTWATCH_API_KEY"Most lists answer a JSON array and put the paging in headers:
| Header | Meaning |
|---|---|
X-Total-Count | Rows matching, over all pages |
X-Page | This page |
X-Limit | Rows per page |
Two lists page in the body instead: issues ({ issues, total, page, limit, … }) and the audit log ({ items, total }). Each endpoint in the reference says which.