GET /api/v1/auth/status as the runtime source for plan and credit context.
Access classes
This table describes API gates, not a pricing comparison. Account packaging can change independently of endpoint behavior.
Credits
- Credits and rate limits are separate controls.
- Current Nexus operations deduct one credit after a validated successful request.
- Enterprise on-demand scans deduct one credit per newly queued scan; a repeat of the same target within 24 hours is free.
- Enterprise accounts are billed for Global Search from the Global Search module’s own credit pool, and need the module enabled. Data Intelligence routes require the Data Intelligence module for Enterprise accounts.
- Organizations DB search and vulnerability, exploit, and advisory search deduct one credit after a validated successful request. A request with no remaining credits returns
403 Forbidden; rejected parameters and backend failures are not charged. - OEM routes marked as credited deduct one OEM credit on their success path.
- OEM credit balance and audit-log operations do not deduct OEM credits.
- A non-deduplicated queued OEM scan consumes a credit; status checks do not.
- Global Search accepts authenticated users with available credits and returns 50 records per page by default (
limitup to 200). - Result limits can also depend on the account and endpoint.
Verify access
user_credits from the response (the profile does not include a plan name). Do not hard-code a marketing plan name as proof that a module is enabled; handle 403 Forbidden from the requested operation.
Production controls
- Check credit context before high-volume jobs.
- Set a per-run request and credit budget in your application.
- Tag OEM requests with stable tenant and request identifiers.
- Stop retrying when the account returns an entitlement or credit failure.
- Reconcile usage from response metadata and OEM audit logs where available.