Skip to main content
The Agent API is an access channel, not a separate product: every call draws on the same account balance and quotas as the web app.

​
What each call consumes

​
Deep scan quota waterfall

A deep run claims quota in this order:
  1. Active subscription (Radar Pro, etc.) - decrements your monthly subscription scan counter.
  2. Lifetime plan (Lifetime Pro / Business) - decrements your monthly lifetime scan counter (10 or 20 scans/month). When the monthly counter is exhausted, the run falls back to tokens if you have any.
  3. Tokens - deducts 1 token from your balance, recorded in the transaction ledger.
No quota and no tokens returns 402 INSUFFICIENT_TOKENS - the run fails before any analysis starts, and nothing is charged.

​
Safety nets

  • Automatic refunds: if a run fails before the analysis actually starts (service disabled, dispatch failure, …), whatever it claimed - token, lifetime scan, subscription scan, Starter scan - is refunded.
  • Idempotent retries: re-POSTing a clientRunId whose run failed before dispatch retries it without double-spending. A run that started always returns its stored outcome.
  • Explicit scanType: agents cannot spend paid quota by accident; deep is always an explicit choice.
  • Failed modules never consume the per-module cap; only a successful generation does.

​
Rate limits

Rate limits key on the API key, not the caller IP, so IP rotation does not widen any window. Repeated failed authentications are the exception: those are throttled per IP, since there is no key to attribute them to. Calls arriving through the hosted MCP server are throttled on their own separate budget instead of a per-IP one, so they never consume the limits of direct API callers. A 429 RATE_LIMITED from any of these limiters carries a Retry-After header with the exact number of seconds until the window resets. See Errors.