Skip to content
API docs
Support

Rate limits and headers

Standard response headers

Section titled “Standard response headers”
X-Request-IDuuid · every response

Identifies the request. Log it: it is required when contacting support about a failed request.

X-Correlation-IDuuid · every response

Identifies the operation across hops. Send your own value to have it echoed back; otherwise it repeats X-Request-ID.

X-Schema-Versiondataset responses

The exact dataset schema version of the payload, given as <dataset>=<major.minor.patch>, e.g. sanctions=1.2.0. See Schema versioning.

X-Snapshot-As-OfISO 8601 UTC timestamp · full-snapshot responses

When the snapshot behind this response was built, e.g. 2026-09-07T20:05:12Z. On /v1/screening/full it is the older of its two dataset builds.

ETagopaque quoted string · full-snapshot responses

Identifies the copy served. Send it back as If-None-Match to skip an unchanged pull.

Cache-Controlfull-snapshot responses

How long the response stays fresh: private, max-age=3600. Responses are per key, so only a private cache may store them. Single-entity lookups set no Cache-Control.

Content-Dispositionfull-snapshot responses

Whether a browser renders or downloads the response: inline for json and jsonl, attachment for csv.

Deprecationtrue · requests using a deprecated path

The path still serves normally. Move to the path in Link.

Retry-Afterseconds · 429 responses

How long to wait before retrying.

X-RateLimit-Limitrpm · 429 responses

The key’s requests-per-minute limit.

X-RateLimit-Remaining0 · 429 responses

Requests remaining against that limit.

X-RateLimit-Resetunix-seconds · 429 responses

When the limit resets.

Rate limiting

Section titled “Rate limiting”

Every key has a requests-per-minute limit, visible in GET /v1/whoami. When exceeded:

HTTP/1.1 429 Too Many Requests
Retry-After: <seconds>
X-RateLimit-Limit: <rpm>
X-RateLimit-Remaining: 0
X-RateLimit-Reset: <unix-seconds>

Honor Retry-After and back off. The X-RateLimit-* headers appear only on the 429 itself, so pace requests against the limit reported by GET /v1/whoami rather than reading them from successful responses.

Caching and conditional requests

Section titled “Caching and conditional requests”
  • Full-snapshot endpoints set Cache-Control: private, max-age=3600, Vary: Authorization and an ETag.
  • Single-entity endpoints set no Cache-Control.

Use conditional requests to skip unchanged snapshots:

curl -s "$BASE_URL/v1/sanctions/full" \
  -H "Authorization: Bearer $API_KEY" \
  -H 'If-None-Match: "<etag-from-last-pull>"'

A matching If-None-Match answers 304 Not Modified with no body when the snapshot has not changed. The ETag changes when the data, the schema version, or your request shape changes.