​
Authentication and access

​
How do I authenticate?

Send the API key in the X-API-KEY header:
FullHunt does not use bearer authentication for the documented REST API. Verify a key with GET /api/v1/auth/status.

​
Which endpoints can my account use?

Access depends on the account plan and enabled modules. Enterprise and OEM routes enforce their own entitlements. Nexus and some intelligence operations also consume credits. See Plans, Access, and Credits.

​
Can I call the API from a browser?

Most authenticated endpoints are intended for server-to-server use and do not expose blanket Cross-Origin Resource Sharing (CORS) access. Proxy browser requests through your backend. Selected public routes and the MCP proxy handle CORS separately.

​
Client libraries and requests

​
Does FullHunt provide official SDKs?

There is no official FullHunt language SDK documented in this repository. Use the OpenAPI specification or the cURL, Python, and JavaScript examples in these docs. Pin your own generated client version and review API changes before regenerating it.

​
What format does the API return?

API operations return JSON unless an endpoint explicitly documents another response, such as an image asset. Error bodies are not identical across every middleware and route, so clients should handle the HTTP status independently from the body shape.

​
How does pagination work?

Pagination is endpoint-specific. Common parameters include page and per_page, but some routes use fixed server-side limits. Pagination metadata is normally returned in the JSON body, not response headers. See Pagination and Filtering.

​
Data and credits

​
How current is the data?

Freshness depends on the dataset and collection method. Use response timestamps such as timestamp, first_seen, last_seen, created_at, or updated_at where available. Do not describe an indexed host lookup as real-time. See Data Provenance and Freshness.

​
Is a credit the same as a rate limit?

No. Rate limits control request frequency. Credits control account consumption. A request can be below its route rate limit and still fail because the account has no remaining credits.

​
How many credits does a Nexus request consume?

Current Nexus lookup and WHOIS operations deduct one credit after a validated successful request. Invalid requests do not represent variable result-size pricing. Check each endpoint and /auth/status for account context.

​
Scanning

​
Can I scan any target?

No. Scan only assets you own or are explicitly authorized to test. Keep an external allowlist and approval record for automated workflows.

​
Can I check scan status?

OEM provides POST /api/v1/oem/on-demand-scan/scan-status. Standard and Enterprise scan triggers do not expose an equivalent documented status endpoint. See OEM On-Demand Scan.

​
Troubleshooting

​
Why do I receive 401 Unauthorized?

The API key is missing or invalid. Confirm the exact X-API-KEY header and test /auth/status.

​
Why do I receive 403 Forbidden?

The key is valid but lacks the required plan, module, authorization, or credits.

​
Why do I receive 429 Too Many Requests?

The route or account limit was exceeded. Back off with jitter and review Rate Limiting.

​
What should I include in a support request?

Include the endpoint, HTTP method, redacted parameters, response status, response body, and UTC timestamp. Never include the API key or exposed credential values. Contact FullHunt support.