# Your plan and quotas

Your plan, your API access, and what you have left this period in quick scans, audits and fixes. Call it before a loop of scans so you do not hit a `402`.

```
GET https://api.rustine.io/v1/account
```

OAuth permission: `scans:read` · an API key has them all

## Response (200 OK)

- `object` (string, required)
- `workspace` (object, required)
  - `id` (string, required) Workspace id.
  - `name` (string, required) Workspace name.
- `plan` (string, required) The plan in force (Free, Solo or Pro). (`free`, `solo`, `pro`)
- `api_access` (object, required)
  - `allowed` (boolean, required) Whether the API and the MCP server answer now.
  - `trial_ends_at` (string | null, required) Solo only: end of the 14-day trial once started; null on Pro, or before the first call.
- `period` (object, required)
  - `start` (string, required) Start of the current 30-day quota period.
  - `end` (string, required) When the counters reset.
- `quotas` (object, required)
  - `quick_scans` (object, required)
    - `limit` (integer, required) Units included this period (all the projects the workspace pays for).
    - `used` (integer, required) Units used this period.
    - `remaining` (integer, required) Units left this period, before pack credits.
  - `audits` (object, required)
    - `limit` (integer, required) Units included this period (all the projects the workspace pays for).
    - `used` (integer, required) Units used this period.
    - `remaining` (integer, required) Units left this period, before pack credits.
  - `fixes` (object, required)
    - `limit` (integer, required) Units included this period (all the projects the workspace pays for).
    - `used` (integer, required) Units used this period.
    - `remaining` (integer, required) Units left this period, before pack credits.
- `free_fixes_left` (integer, required) Fixes given once to a Free workspace, still unused.
- `pack_credits` (object, required)
  - `scans` (integer, required) Scan credits from packs, used once the period's quota is spent.
  - `fixes` (integer, required) Fix credits from packs, used once the period's quota is spent.
- `projects` (object, required)
  - `limit` (integer, required) Open projects allowed by the plan (included and extra).
  - `used` (integer, required) Projects in the workspace, paused ones included.
  - `paused` (integer, required) Projects paused because the plan covers fewer projects.
- `addresses_per_project` (integer, required) Addresses (hostnames) a project may follow on this plan.
- `features` (object, required)
  - `full_audit` (boolean, required) Full audits (Solo, Pro).
  - `repositories` (boolean, required) GitHub repository analyses (Solo, Pro).
  - `ai_fix` (boolean, required) AI Fix, Rustine writes the patch (Solo, Pro).
  - `alerts` (boolean, required) Score-drop and new-advisory alerts (Pro).

## Examples

### curl

```bash
# The key stays in a variable, never in the address
curl https://api.rustine.io/v1/account \
  -H "Authorization: Bearer $RUSTINE_API_KEY"
```

### Node

```js
const res = await fetch(
  "https://api.rustine.io/v1/account",
  {
    headers: {
      Authorization: `Bearer ${process.env.RUSTINE_API_KEY}`,
    },
  },
)
const account = await res.json()
```

### Python

```python
import os

import requests

account = requests.get(
    "https://api.rustine.io/v1/account",
    headers={
        "Authorization": f"Bearer {os.environ['RUSTINE_API_KEY']}",
    },
).json()
```

### Response: 200 OK

```json
{
  "object": "account",
  "workspace": {
    "id": "0b6f4a52-3c1e-4d7a-9f2e-5a8c1d3e7b90",
    "name": "example.com"
  },
  "plan": "pro",
  "api_access": {
    "allowed": true,
    "trial_ends_at": null
  },
  "period": {
    "start": "2026-10-01T00:00:00.000Z",
    "end": "2026-10-31T00:00:00.000Z"
  },
  "quotas": {
    "quick_scans": {
      "limit": 300,
      "used": 12,
      "remaining": 288
    },
    "audits": {
      "limit": 180,
      "used": 4,
      "remaining": 176
    },
    "fixes": {
      "limit": 90,
      "used": 7,
      "remaining": 83
    }
  },
  "free_fixes_left": 0,
  "pack_credits": {
    "scans": 0,
    "fixes": 10
  },
  "projects": {
    "limit": 3,
    "used": 2,
    "paused": 0
  },
  "addresses_per_project": 20,
  "features": {
    "full_audit": true,
    "repositories": true,
    "ai_fix": true,
    "alerts": true
  }
}
```

## Errors

| Status | error.code | What happens |
| --- | --- | --- |
| 401 | `authentication_required` | No key in the request. Pass it in the `Authorization: Bearer rst_…` header, never in the address. |
| 401 | `invalid_api_key` | The key or OAuth token is wrong, revoked or expired. Check it is copied in full, or create a new key. |
| 402 | `api_plan_required` | The workspace is on the Free plan. The API comes with Pro, or on a 14-day trial with Solo. |
| 402 | `api_trial_ended` | Solo's 14-day trial is over. Move to Pro: your keys work again at once. |
| 403 | `scope_missing` | The OAuth token lacks the permission this route needs (shown on its page). Reconnect the agent to grant it. An API key has every permission. |
| 429 | `rate_limited` | Too many requests for this key (120 per minute). Wait `Retry-After` seconds. |
| 500 | `internal_error` | An error on our side, reported automatically. Retry later; give the `Request-Id` to support if it comes back. |
| 503 | `service_unavailable` | Rustine is unavailable for a moment. Retry with the same `Idempotency-Key`. |

https://docs.rustine.io/en/api/errors