Plans, quotas and capacity

​

The four checks

​

License in force

{
  "detail": "Your license is not active."
}

​

Plan features

{
  "detail": "This feature is not included in your plan."
}

​

Which plans include each feature

​

What needs only a license in force

• Quick search. Each source still needs its own feature. A source your plan excludes comes back with "status": "not_entitled", and the other sources still run.
• Leaked credentials: Raw Data, Filtered credentials, the ULP feed, stealer logs, Credential Check and credential exposure analytics.
• SSL Transparency Logs, new domain registrations and Data Brokers listings.
• Risk score.
• Monitor matches, exclusions and metrics, and email delivery to recipients.
• The export service and leak-file downloads in Downloads and exports. A source’s own file endpoint follows its source. For example, the Code exposure export needs Exposed Code Detection, and the Attack Surface report download needs an Attack Surface feature.
• Every other endpoint of Credit cards, Tor & I2P and Email References, such as results, status, details and deletes. Only the search call checks the feature.
• Reading custom senders and email templates.
• The two Live Data Broker purchase endpoints.

​

What needs only a valid API key

• Every phishing references endpoint.
• The results of Open cloud storage, URL shortener, App store and Infra search requests, and infra_search_stats.
• Listing credential comparison reports, checking their status, downloading them and deleting them.
• get_direct_org_info.

​

Monitors and their data sources

​

Metered allowances

​

How units are counted

• Taken before the call runs. Reads, polling, results, lists and deletes use no units.
• Refunded on any non-2xx response. A 2xx response keeps its units, even if the job it started fails later or you delete it.
• All or nothing. A call that needs more units than remain is refused whole. No units are taken.
• Counted per unique keyword for Code exposure. Keywords are compared case-insensitively across every source in one request. The request below uses 2 units: acme.com and ACME.com count once.

curl https://client-api.leak.center/api/code_scan/keyword_scans/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sources": [
      {"source": "github", "keywords": [{"keyword": "acme.com"}, {"keyword": "acme-login.com"}]},
      {"source": "postman", "keywords": [{"keyword": "ACME.com"}]}
    ]
  }'

​

Windows

​

Packs

​

When an allowance is spent

{
  "detail": "You have reached your Code Exposure Keyword Search limit for this month.",
  "resource": "code_exposure_keyword_search",
  "period": "month",
  "limit": 10
}

• resource is the allowance from the table above. Branch on it, not on detail.
• period is the window that ran out. It is month for every allowance except Domain takedowns, which use year. Read it from the body rather than assume it.
• limit is your organization’s units for the window, packs included.

​

Capacity slots

{
  "detail": "You have reached your Monitored Assets limit of 25.",
  "resource": "monitored_assets",
  "limit": 25
}

• Monitors. One monitor holds one slot until you delete it.
• Domain monitoring. Each scanned domain holds a slot from the same Monitored Assets pool as your monitors. At the limit, start_domain_analysis returns 409 for any domain, including one you already scan. To scan a monitored domain again, use analysis_rescan, which needs no free slot.
• Report schedules. Only active schedules hold a slot. A plan can include zero schedule slots, and then every active schedule is refused. A schedule created with is_active set to false holds no slot. To pause or resume a schedule, update_report_schedule needs the schedule’s domains and mask_passwords in the body as well as is_active, for example {"domains": ["acme.com"], "is_active": false, "mask_passwords": true}. See Change, pause or resume a schedule.

​

API Calls allowance

​

Where to see your plan and usage

• Manage → Usage shows what is used and left of each allowance and slot, and when each one resets. Org Admins, System Admins and System Users can open it.
• Manage → Buy more shows the features your plan includes and the packs it can add. Org Admins and System Admins can buy packs and change the plan there.

• limit in every 429 allowance body and every 409 capacity body gives your current total.
• get_api_call_usage returns every request your organization made, from the dashboard and with API keys, per month and per day, broken down by status code. It is a traffic log, not your API Calls allowance balance.

​

Client workspaces

​

Endpoints