# Limits and paging

## Request budgets

Each API key, and each OAuth connection, may send per minute:

| Requests | Per minute |
|---|---|
| Reads (`GET`) | 120 |
| Writes (everything else) | 60 |

Every answer carries the budget:

| Header | Meaning |
|---|---|
| `RateLimit-Limit` | Requests of this kind allowed per minute |
| `RateLimit-Remaining` | Requests left this minute |
| `RateLimit-Reset` | Seconds until the budget resets |

Past the budget the API answers `429` with the code `RATE_LIMITED` and a `Retry-After` header: wait that many seconds. Independently, each IP address may send 10 requests a second (bursts of 20).

## Heavy operations

A few operations also have a budget per workspace, whoever calls:

| Operation | Limit |
|---|---|
| The outside view of an asset | 120 a minute |
| Run discovery | 10 an hour |
| Check an asset again | 30 an hour |
| Create an assessment report | 10 an hour |
| Export the audit log | 10 an hour |

Your plan's limits apply as in the dashboard: on-demand scans have daily limits per asset and per workspace (`403 LIMIT_REACHED`), and an asset past your plan's included ones needs a paid slot, which only the dashboard can buy (`403 EXTRA_PURCHASE_NOT_ALLOWED`).

## Paging

Lists come in pages. Send `page` (from 1) and `limit` (rows per page: 100 when you send none, at most 500):

```bash
curl "https://api.fortwatch.ai/app/scans?page=2&limit=200" -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

Most lists answer a JSON array and put the paging in headers:

| Header | Meaning |
|---|---|
| `X-Total-Count` | Rows matching, over all pages |
| `X-Page` | This page |
| `X-Limit` | Rows per page |

Two lists page in the body instead: issues (`{ issues, total, page, limit, … }`) and the audit log (`{ items, total }`). Each endpoint in the [reference](/api) says which.