Documentation/Error handling

Error handling

Build clients around status codes, retry headers, and idempotent request behavior.

Status codes

200

Success. Use the response body.

400

Invalid input. Correct the request body, CVE format, or query parameters.

401

Missing or invalid key. Check bearer token and key status.

403

Tier does not include endpoint. Change endpoint or use a tier that includes it.

404

CVE not found. Verify the CVE upstream.

429

Rate limit exceeded. Back off using Retry-After.

500/503

Service unavailable. Retry with bounded exponential backoff.

For the full error schema, see API Reference: ErrorResponse.

Retry policy

  • Retry 429, 500, and 503.
  • Do not retry 400, 401, or 403 without changing the request.
  • Use jitter to avoid synchronized retry bursts.
  • Cap retries for batch jobs so a single bad upstream state cannot stall a pipeline.

Rate limits

Free keys allow 20 requests/min and 500 requests/month. Pro allows 200 requests/min. Business allows 1000 requests/min. Enterprise limits are custom.