Limits

All limits are per IP address.

What	Limit
Starting a scan	1 per 24 hours, shared with the website
Everything else	60 requests per minute

The website and the API share one daily scan: using it on either uses it up on both. Polling a scan every 2 seconds for its full minute takes about 30 requests. A scan request rejected for another reason, like a bad URL or a full queue, doesn’t use up your scan.

Headers

GET responses, and scan requests that are accepted or rate-limited, include:

Header	Meaning
`X-RateLimit-Limit`	Requests allowed in the window.
`X-RateLimit-Remaining`	Requests left.
`X-RateLimit-Reset`	When the window resets, as a Unix timestamp.

When you hit a limit

You get 429, with a Retry-After header in seconds:

{
  "error": "The free limit is 1 scan per 24 hours per IP address, shared with the website.",
  "retryAfterSeconds": 86400,
  "retryAfterHuman": "24 hours",
  "resetAt": "2026-09-24T23:33:06.413Z"
}

If the scan queue is full you get 503 instead, also with Retry-After. Check GET /api/v1/quota before starting a scan to avoid a wasted request.

From a browser

The GET endpoints accept requests from any origin. Starting a scan doesn’t: call POST /api/v1/scan from a server or script.

Support

Questions, or want your site removed? Email hi@aicortez.com.

Get started

API reference

Headers

When you hit a limit

From a browser

Support

​Headers

​When you hit a limit

​From a browser

​Support

Headers

When you hit a limit

From a browser

Support