Public docs
Authentication
API keys, plans, rate limits, and error handling.
Phase 1 shell: this docs surface is wired to the existing backend and repo documentation, and will be expanded as the private dashboard comes online.
How authentication works
Every Core API request must include the X-API-Key header.
X-API-Key: your_api_key_hereMissing or invalid keys return a 401 error. Using AI mode on a free key returns 403.
Plans
There are two plan levels:
Free
- Deterministic analysis only (
mode: "basic") - 60 requests per 60 seconds
- Full structured output: summaries, risk flags, extracted changes, impact level
Pro
- Everything in Free, plus:
- AI mode (
mode: "ai") — GPT-4o-mini enrichment - Executive summaries, partner email drafts, scope-level impact reasoning
- 300 requests per 60 seconds
Rate limits
Rate limits are enforced per API key:
- Free: 60 requests / 60 seconds
- Pro: 300 requests / 60 seconds
When the limit is exceeded, the API returns 429 with a retry hint:
{ "detail": "Rate limit exceeded. Try again in ~17s." }Error reference
| Status | Meaning | | 401 | Missing or invalid X-API-Key | | 403 | AI mode requires a Pro key | | 404 | Resource not found | | 422 | Validation error — check your request body | | 429 | Rate limit exceeded | | 500 | Internal server error |
Authentication errors
// Response when X-API-Key is not included{ "detail": "Missing X-API-Key header"}