Search results
Credits & usage
Your access plan defines permissions, available credits or cycle quota, charging rates and any expiration.
IOC and relationship queries
Including relationships or increasing the requested limit may use more credits, even when fewer items are returned. Charges depend on your access plan.
Each page and retry is a separate request. Queries with no matching record, or requests interrupted after processing begins, may still use credits.
Feed queries
Feed credit usage depends on the events returned and your access plan. Larger result pages may use more credits. Successful feed requests count toward usage even when no events are returned.
Allow a pause between polls and process each page before requesting the next.
Remaining quota
Native responses report the remaining credits or cycle quota in meta.quota_remaining; STIX feed responses use X-Quota-Remaining.
Rate limits and total quota are separate controls. Handle 429 even when your balance is positive. See your access plan or contact us for your applicable rates.
Errors & retries
{
"detail": {
"error": {"code": 7, "message": "quota exceeded"}
}
}| HTTP status | Meaning | Action |
|---|---|---|
| 400 | Invalid parameters, cursor or limit | Correct the request before retrying. |
| 401 | Missing, invalid or expired API key | Check the x-api-key header and key validity. Contact support if access needs renewal. |
| 403 | Quota exceeded, account disabled or permission denied | Inspect detail.error.code and message; request quota or permissions as needed. |
| 404 | IOC or relationship not found | Treat as no available result, not a safe verdict. Check type and relation. |
| 422 | Request validation error | Inspect the validation details for incorrect parameter types or ranges. |
| 429 | Rate limit exceeded | Respect Retry-After if present; otherwise use bounded exponential backoff with jitter. |
| 500 / 502 / 503 / 504 | Server or upstream failure | Retry conservatively; keep retry count bounded and remember a retry may consume quota. |
Use explicit connection and read timeouts. A client timeout does not prove that the server cancelled a query or refunded its cost. Avoid unlimited retry loops.
Integration checklist & support
- Verify the issued key’s endpoints, permissions, quota and expiration.
- Start with a small, representative set of your own indicators.
- Tolerate omitted optional fields and unknown additional fields.
- Limit concurrency, handle errors and persist pagination checkpoints.
- Measure coverage and usefulness separately from detection accuracy.
- Confirm commercial integration, caching and redistribution rights before production use.
When reporting an issue, include the endpoint, UTC timestamp, HTTP status and meta.request_id if available. Never send your API key. Remove sensitive indicators unless they are necessary for troubleshooting.
API v1 · Contact us for integration help or to review your access plan.