Rate limits

The Hacktron REST API limits the number of requests each API key can make.

Limit

Each API key can make 100 requests per 60 seconds, counted across all REST endpoints.

The window rolls, with no fixed start or end time. After 100 requests at t=0, the API accepts the next request at about t=60s.

Requests authenticated with a dashboard session, not an API key, don’t count against this limit.

429 responses

A key that goes over the limit gets 429 Too Many Requests:

1
HTTP/1.1 429 Too Many Requests
2
Content-Type: application/json
3

4
{
5
  "statusCode": 429,
6
  "message": "ThrottlerException: Too Many Requests"
7
}

The API rejects the request before it reaches the application, so the request body isn’t consumed.

Backing off

When a client gets a 429, it should:

1. Stop sending requests with that key.

2. Retry with exponential backoff, for example after 1s, 2s, 4s, and 8s.

3. If it hits the limit consistently, spread the work over a longer window or ask Hacktron support for a higher quota.

For work that needs more sustained throughput, such as backfilling findings into an external system, email support at founders@hacktron.ai with the use case.

Concurrency and long-running scans

POST /scans queues the scan and returns straight away, so you don’t hold a connection open while the scan runs. To follow a scan:

1. Call POST /scans to start it, and keep the id it returns.

2. Call GET /scans/{id}/status every 10 to 30 seconds to check progress.

3. Once status is completed, fetch the findings with GET /scans/{id}/findings or GET /scans/{id}/findings/export.

Polling counts toward the rate limit, so poll no more often than every 10 seconds.