Rate Limiting

Rate limiting is applied to FullHunt API endpoints to ensure fair usage and predictable performance. Limits are enforced per route and may also be affected by account tier and credit balance.

Rate-limit storage and enforcement infrastructure are implementation details and may differ by deployment. Clients should rely on HTTP status codes, response headers when present, and the documented per-route limits rather than assuming a specific backend such as Redis.

Rate Limiting Factors

Rate limiting is applied based on the following factors:

Endpoint: Each route can define its own request limit
User Credits: Your monthly credit allocation
User Plan: Different limits for different subscription tiers
Authentication State: Authenticated requests are associated with the API key/account; unauthenticated public endpoints may fall back to source IP

Standard Rate Limits

API Request Limits

There is no single global request limit. Many endpoints allow 60 requests per minute, but several public, search, host lookup, feed, enterprise, and OEM endpoints use stricter or broader limits.

Specific Endpoint Limits

Endpoint or Category	Rate Limit
`GET /api/v1/domain/<domain>/subdomains`	200 requests/hour
`GET /api/v1/domain/<domain>/details`	200 requests/hour
`GET /api/v1/host/<host>`	10 requests/minute
`GET /api/v1/search/suggestions`	10 requests/minute
`GET /api/v1/search/suggestions/orgs`	10 requests/minute
`POST /api/v1/global/search`	60 requests/minute
`GET /api/v1/intel/<route_type>`	60 requests/minute
Nexus lookups	60 requests/minute for most endpoints
`GET /api/v1/nexus/whois/search`	30 requests/minute
Vulnerability, exploit, and advisory search	60 requests/minute
`GET /api/v1/vulnerability-intelligence/feed`	30 requests/minute
Enterprise organization create/delete and scan trigger endpoints	10 requests/minute
Enterprise list and asset-management endpoints	20 requests/minute for core org/entity/asset routes; 60 requests/minute for suggested domains, dark web, and certificates
OEM on-demand scan	5 requests/minute
OEM scan status	10 requests/minute
OEM account credits	30 requests/minute
OEM audit logs	15 requests/minute
OEM lookup/search endpoints	Usually 60 requests/minute when a route-specific limit is set; some partner search routes use the API service default plus OEM credit controls
Public logo endpoint	20 requests/minute
Public technology icon endpoints	60-120 requests/minute, depending on endpoint
Public 0day.today archive search	10 requests/minute
Stressful.io public telemetry endpoints	60-120 requests/minute, depending on endpoint

Rate Limit Headers

API responses may include rate limit information in the headers:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1634004417

Header	Description
`X-RateLimit-Limit`	The maximum number of requests allowed per minute
`X-RateLimit-Remaining`	The number of requests remaining in the current window
`X-RateLimit-Reset`	The time when the rate limit window resets (Unix timestamp)

Rate Limit Exceeded Response

When you exceed the rate limit, you’ll receive a 429 Too Many Requests response:

{
  "error": "Rate Limit Exceeded",
  "message": "Too many requests. Please try again later."
}

Credit Limits

In addition to rate limits, API usage is subject to credit limits:

Community accounts: Limited results per query
Enterprise accounts: Full access to all results
Credits are consumed separately from request rate limits. Check the endpoint reference for whether a request deducts credits.

Best Practices

Implement Exponential Backoff

When you receive a rate limit error, implement exponential backoff:

# Example with retry logic
for i in {1..5}; do
  response=$(curl -s -w "%{http_code}" "https://fullhunt.io/api/v1/domain/example.com/details" \
    -H "X-API-KEY: your-api-key")
  
  if [[ "${response: -3}" != "429" ]]; then
    echo "Success: ${response::-3}"
    break
  fi
  
  echo "Rate limited, waiting $((2**i)) seconds..."
  sleep $((2**i))
done

Monitor Rate Limit Headers

When rate limit headers are present, use them to pace requests:

import requests
import time

def make_api_request(url, headers):
    response = requests.get(url, headers=headers)
    
    # Use rate limit headers when present
    limit = int(response.headers.get('X-RateLimit-Limit', 0))
    remaining = int(response.headers.get('X-RateLimit-Remaining', 0))
    reset = int(response.headers.get('X-RateLimit-Reset', 0))
    
    print(f"Rate limit: {remaining}/{limit}")
    
    if remaining < 5:  # Close to limit
        wait_time = reset - int(time.time())
        print(f"Approaching rate limit, waiting {wait_time} seconds")
        time.sleep(max(wait_time, 0))
    
    return response

Batch Your Requests

Instead of making many individual requests, consider:

Using Global Search APIs for broader queries
Implementing request queuing in your application
Spreading requests over time

Cache Results

Implement caching to reduce API calls:

Cache frequently accessed domain information
Use appropriate cache TTLs based on data freshness needs
Implement cache invalidation strategies

Enterprise Rate Limits

Enterprise customers may have different rate limits:

Higher request rates per minute
Dedicated infrastructure for improved performance
Custom rate limits based on usage patterns
Priority support for rate limit adjustments

Contact FullHunt support to discuss custom rate limits for your enterprise needs.

Monitoring Your Usage

Track your API usage through:

Rate limit headers in API responses, when present
Your FullHunt dashboard
API usage analytics and reporting tools

Contact Support

If you need higher rate limits or have questions about rate limiting:

Contact FullHunt support
Upgrade to an Enterprise plan for higher limits
Consider the OEM APIs for partner integrations

Get Started

Integration Foundations

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Generated API Reference

Agentic AI (MCP)

Rate Limiting Factors

Standard Rate Limits

API Request Limits

Specific Endpoint Limits

Rate Limit Headers

Rate Limit Exceeded Response

Credit Limits

Best Practices

Implement Exponential Backoff

Monitor Rate Limit Headers

Batch Your Requests

Cache Results

Enterprise Rate Limits

Monitoring Your Usage

Contact Support

​Rate Limiting Factors

​Standard Rate Limits

​API Request Limits

​Specific Endpoint Limits

​Rate Limit Headers

​Rate Limit Exceeded Response

​Credit Limits

​Best Practices

​Implement Exponential Backoff

​Monitor Rate Limit Headers

​Batch Your Requests

​Cache Results

​Enterprise Rate Limits

​Monitoring Your Usage

​Contact Support

Rate Limiting Factors

Standard Rate Limits

API Request Limits

Specific Endpoint Limits

Rate Limit Headers

Rate Limit Exceeded Response

Credit Limits

Best Practices

Implement Exponential Backoff

Monitor Rate Limit Headers

Batch Your Requests

Cache Results

Enterprise Rate Limits

Monitoring Your Usage

Contact Support