Your plan and quotas
Your plan, your API access, and what you have left this period in quick scans, audits and fixes. Call it before a loop of scans so you do not hit a 402.
OAuth permission: scans:read · an API key has them all
Response
objectstringworkspaceobjectidstringWorkspace id.
namestringWorkspace name.
planstringThe plan in force (Free, Solo or Pro).
freesoloproapi_accessobjectallowedbooleanWhether the API and the MCP server answer now.
trial_ends_atstring | nullSolo only: end of the 14-day trial once started; null on Pro, or before the first call.
periodobjectstartstringStart of the current 30-day quota period.
endstringWhen the counters reset.
quotasobjectquick_scansobjectlimitintegerUnits included this period (all the projects the workspace pays for).
usedintegerUnits used this period.
remainingintegerUnits left this period, before pack credits.
auditsobjectlimitintegerUnits included this period (all the projects the workspace pays for).
usedintegerUnits used this period.
remainingintegerUnits left this period, before pack credits.
fixesobjectlimitintegerUnits included this period (all the projects the workspace pays for).
usedintegerUnits used this period.
remainingintegerUnits left this period, before pack credits.
free_fixes_leftintegerFixes given once to a Free workspace, still unused.
pack_creditsobjectscansintegerScan credits from packs, used once the period's quota is spent.
fixesintegerFix credits from packs, used once the period's quota is spent.
projectsobjectlimitintegerOpen projects allowed by the plan (included and extra).
usedintegerProjects in the workspace, paused ones included.
pausedintegerProjects paused because the plan covers fewer projects.
addresses_per_projectintegerAddresses (hostnames) a project may follow on this plan.
featuresobjectfull_auditbooleanFull audits (Solo, Pro).
repositoriesbooleanGitHub repository analyses (Solo, Pro).
ai_fixbooleanAI Fix, Rustine writes the patch (Solo, Pro).
alertsbooleanScore-drop and new-advisory alerts (Pro).
Errors
| Status | error.code | What happens |
|---|---|---|
| 401 | authentication_required | No key in the request. Pass it in the Authorization: Bearer rst_… header, never in the address. |
| 401 | invalid_api_key | The key or OAuth token is wrong, revoked or expired. Check it is copied in full, or create a new key. |
| 402 | api_plan_required | The workspace is on the Free plan. The API comes with Pro, or on a 14-day trial with Solo. |
| 402 | api_trial_ended | Solo's 14-day trial is over. Move to Pro: your keys work again at once. |
| 403 | scope_missing | The OAuth token lacks the permission this route needs (shown on its page). Reconnect the agent to grant it. An API key has every permission. |
| 429 | rate_limited | Too many requests for this key (120 per minute). Wait Retry-After seconds. |
| 500 | internal_error | An error on our side, reported automatically. Retry later; give the Request-Id to support if it comes back. |
| 503 | service_unavailable | Rustine is unavailable for a moment. Retry with the same Idempotency-Key. |