Limits

Credential limits

Free supports 1 active Access Key, Builder 3, Pro 20 and Enterprise 100. The list route returns at most 50 keys in the current Console response.

Only the Free plan has a monthly free-call allowance: 10 REST developer calls per month. MCP is planned and does not add separate calls. A successful Free call consumes one call regardless of the operation's paid-credit price.

Builder, Pro and Enterprise do not receive free calls; they receive included plan credits instead (see Plans). Do not add a paid plan's included credits to the Free-call count — they are different balance types with different consumption rules.

Registry API

Public registry search is limited per IP and validates page size and query length. Successful browse and search responses use short shared-cache windows; invalid query parameters return 400.

Timeouts

The operation runner bounds each inVerus scoring attempt to 20 seconds. A supported 429 retry waits briefly and may use a second attempt, so clients should allow 50 seconds for the full request. Provider asset requests use separate bounded timeouts. Retry the same logical operation only with the same idempotency key.

Exact rate-limit numbers can vary by deployment. Read Retry-After when returned instead of hard-coding a delay.

Request validation limits

Registry query length and page size are bounded by shared constants. Operation identifiers must match one of the six canonical values, subjects cannot be empty, and every operation needs an idempotency key. Provider callbacks also enforce short-lived state and intent windows.

Plan boundaries

Key limits are enforced server-side during creation. Free-call allowances reset according to the current monthly balance record. Included paid credits follow the subscription/billing-cycle synchronization behavior; prepaid credits remain until consumed according to product terms.

Client backoff

const RETRYABLE_STATUS = new Set([429, 500, 502, 503])

async function withBackoff(run: () => Promise<Response>, attempts = 3) {
  let lastNetworkError: unknown

  for (let attempt = 0; attempt < attempts; attempt += 1) {
    try {
      const response = await run()
      if (!RETRYABLE_STATUS.has(response.status) || attempt === attempts - 1) {
        return response
      }

      const retryAfter = Number(response.headers.get('retry-after'))
      const baseDelay = Number.isFinite(retryAfter) && retryAfter > 0
        ? retryAfter * 1_000
        : 500 * 2 ** attempt
      await new Promise(resolve => setTimeout(resolve, baseDelay + Math.random() * 250))
    } catch (error) {
      const isNetworkFailure = error instanceof TypeError ||
        (error instanceof DOMException && error.name === 'AbortError')
      if (!isNetworkFailure) throw error

      lastNetworkError = error
      if (attempt === attempts - 1) throw error
      await new Promise(resolve => setTimeout(resolve, 500 * 2 ** attempt + Math.random() * 250))
    }
  }

  throw lastNetworkError
}

Use backoff only for network failures or 429, 500, 502 and 503 outcomes. Preserve the same operation idempotency key across every attempt. Do not retry 400, 401, 402, 403 or 409 unchanged.

Throughput design

Avoid refreshing the same Page from several clients at once. Cache assessment results according to your freshness policy, deduplicate queue jobs by canonical Page ID and operation, and use the public registry search cache for browsing rather than issuing one query per card.

Limit responses

A credential count limit should identify the plan and direct the user to revoke an unused key or change plan. 402 indicates no eligible usage source. 429 indicates a temporary request-rate boundary. Keep those states separate in UI and monitoring.