429 handling
Over the limit, the API returns 429. Wait for X-RateLimit-Reset, then retry with backoff.
API & Tools
Rate Limits by plan
Each plan pairs a per-minute burst limit with a monthly quota. Responses carry the burst in X-RateLimit-* and, on metered calls, the monthly quota in X-Monthly-*.
No credit card required · Free API key
Limits
Limits by plan. Checks and scans have separate quotas.
| Plan | Burst | Checks / month | Scans / month |
|---|---|---|---|
| FREE | 60 / min | 250 | 1,000 |
| BASIC | 60 / min | 2,000 | 25,000 |
| PRO | 60 / min | 10,000 | 250,000 |
| ENTERPRISE | 5,000 / min | 1,000,000 | 1,000,000 |
BASIC has the same burst as FREE and PRO, 60 requests a minute; it raises the monthly quota to 2,000 API requests.
| Header | Meaning |
|---|---|
| X-RateLimit-Limit | Maximum requests allowed |
| X-RateLimit-Remaining | Requests remaining |
| X-RateLimit-Reset | Unix timestamp of the reset, in milliseconds |
Scans apply only to the /gate surface (prompt-injection and link scanning) and never consume checks.
- Free/Month
- 250
- Pro/Month
- 10K
- Enterprise/Month
- 1M
Capabilities
Key features at a glance.
Usage Dashboard
Track this month’s usage from the dashboard.
Custom Limits
Enterprise customers can request custom limits.
Applications
Use cases to evaluate first.
Request Batching
Group lookups in POST /bulk/check instead of one call per indicator.
Caching Strategy
Cache responses to reduce API calls.
FAQ
Frequently asked questions.
What are the rate limits per plan?
Free: 250/month, 60/minute. Pro: 10,000/month, 60/minute. Enterprise: 1,000,000/month, 5,000/minute.
How do I know my current usage?
Two sets of headers. X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset describe the per-minute burst (Reset is in milliseconds since the Unix epoch). X-Monthly-Usage, X-Monthly-Limit and X-Monthly-Percentage describe the monthly quota, which resets on the 1st at 00:00 UTC. The dashboard shows the same monthly count.
What happens if I exceed the limit?
You'll receive a 429 Too Many Requests response. For a per-minute (burst) 429, wait the number of seconds in Retry-After, then resume with backoff. For a monthly-quota 429, do not retry: the quota resets on the 1st of next month at 00:00 UTC (Retry-After counts down to it), and X-Monthly-Usage / X-Monthly-Limit show where you stand.
Can I request a rate limit increase?
Enterprise customers can request custom rate limits. Contact contact@ismalicious.com to discuss your needs.
Research
Related articles from the research blog.
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Hash Reputation at Scale: Building Detection Rules That Survive Real Networks
Move beyond one-off hash blocks: design reputation pipelines, reduce false positives, and integrate file intelligence with IP and domain context for production-ready detection engineering.
Read moreTest it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key