Developer reference
Rate limits
DomScan API: Authenticated responses also carry X-RateLimit-Reset , the Unix time in seconds when your burst capacity is fully refilled.
Rate limits
- Free accounts: 120 requests per minute, with a burst of 60. This budget is shared by every API key and dashboard session on the account.
- Paid accounts: 600 requests per minute, with a burst of 120. Counted per API key, or per IP for dashboard sessions.
- Bulk endpoints on free accounts: An additional 20 requests per minute per account, and 100 per minute per network.
- Cached requests (prefer_cache=1): Still counted against your rate limit, but they respond faster and skip the upstream lookup.
- Bulk endpoint: 50 domains per request
- TLDs per request: 50 maximum
Exceeding a limit returns HTTP 429 with a
Retry-After header. Every authenticated response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Policy, so you can track your remaining budget instead of guessing.
Authenticated responses also carry X-RateLimit-Reset, the Unix time in seconds when your burst capacity is fully refilled.