Rate limits and credits.
API usage is governed by two independent mechanisms: a per-key rate limit that protects the platform from bursts, and a per-account credit pool that meters overall monthly usage. Every response reports both, so a well-behaved integration never has to guess.
Rate limits
Each key gets a fixed-window limit, 120 requests per minute by default. If your use case needs more, the limit is configurable per key through support.
Every response includes:
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118
X-RateLimit-Reset: 1751979840
X-RateLimit-Reset is the Unix epoch second when the current window resets. Going over
the limit returns 429 Too Many Requests with a Retry-After header telling you how
long to back off.
Honour Retry-After rather than retrying on a fixed schedule. The header is exact, so
you resume the moment the window opens instead of guessing and burning attempts.
Credits
Each billing account has a monthly credit pool. The Enterprise default is 2,000,000 credits per month, lower tiers scale down from there, and per-account overrides are possible. Two headers ride along on every response:
X-Credits-Limit: 2000000
X-Credits-Remaining: 1973435
Only successful requests are charged. Anything that returns a 4xx or 5xx costs nothing,
so errors and rate-limited retries never eat your pool. When the pool is exhausted,
requests return 402 Payment Required.
Credit costs per endpoint
| Endpoint group | Credits |
|---|---|
| IOC lookup or list | 1 |
| IOC export (CSV or STIX) | 10 |
| Events list or detail | 1 |
| Event ingest | 10 |
| Threat library list or detail | 1 |
| Reports list | 1 |
| Report detail | 2 |
| Report download | 5 |
| Report generate | 50 per organization in the request |
| Alerts list or matches | 1 |
| Organizations list or detail | 1 |
| Document upload | 25 |
| Entity confirm | 5 |
| Description update | 10 |
Report generation is the one cost that scales with input: generating for three organizations in one call costs 150 credits, because the platform produces a tailored report for each organization.
The interactive reference at https://api.liberty91.com/api/v1/docs/ and the schema endpoint are free and unauthenticated, so exploring the API never costs anything.
Budgeting in practice
For most integrations the arithmetic is comfortable. A SIEM enrichment that looks up
5,000 indicators a day spends 5,000 credits a day, around 150,000 a month, well inside an
Enterprise pool. Keep an eye on X-Credits-Remaining in your integration's logging and
alert at a sensible floor, and you will never be surprised by a 402.
Frequently asked questions
What is the Liberty91 API rate limit?
By default each key can make 120 requests per minute in a fixed window. The limit is
configurable per key through support, and every response tells you how much headroom
remains via X-RateLimit headers.
Am I charged credits for failed API requests?
No. Only successful requests (HTTP status below 400) consume credits. Rate-limited, unauthorized, and server-error responses are never charged.
What happens when my credit pool runs out?
Requests return 402 Payment Required until the pool resets for the new month or your
plan is adjusted. Read the X-Credits-Remaining header to alert well before you get
there.