Rate limits
Quota headers and 429 handling for POST /api/v1/scans.
Scan quota is per user, per clock hour. Every successful or attempted scan that passes auth consumes one unit, including dashboard uploads.
Response headers
X-RateLimit-Limit: 5
X-RateLimit-Remaining: 3
X-RateLimit-Reset: 1710000000
X-RateLimit-Reset is a Unix timestamp in seconds.
Handling 429
javascript
async function scanFile(file, apiKey) {
const body = new FormData()
body.append('file', file)
const response = await fetch('https://api.trythreatless.com/api/v1/scans', {
method: 'POST',
headers: { 'X-API-KEY': apiKey },
body
})
if (response.status === 429) {
const retryAfter = Number(response.headers.get('Retry-After') || 60)
throw new Error(`Quota exhausted. Retry in ${retryAfter}s`)
}
if (!response.ok) {
throw new Error(`Scan failed: ${response.status}`)
}
return await response.json()
}
Upgrade the plan when you consistently hit the ceiling — see Plans & billing.
Keys on the same account share the quota. Creating more keys does not increase throughput.