Errors, limits and security

HTTP response contract

Status	Meaning / next step
200 / 201	Success / new order created; inspect order_status and data.
401	Missing, invalid, expired, revoked or ineligible key. Check environment and owner access.
403	Source IP, read-only permission, Enterprise option, billing or security restriction.
404	Resource not available to this customer, or unknown route/UUID.
409	Idempotency conflict/processing review, or observed IP changed.
422	Invalid parameters, missing explicit confirmation, quota or incompatible lifecycle state.
429	Rate limit; wait for Retry-After and back off.
5xx / timeout	Do not blindly repeat a mutation. Recover creation with the same Idempotency-Key; otherwise inspect current state.

Send Accept: application/json. Errors contain a message and validation errors may include an errors object keyed by field. Treat messages as human-readable, not stable machine identifiers.

{
  "message": "The confirm field must be accepted.",
  "errors": {
    "confirm": [
      "The confirm field must be accepted."
    ]
  }
}

Limits

• 60 API requests per minute per source IP; multiple keys behind the same IP share this limit.
• 1–100 licenses per order and up to 100 list results per page.
• Pending-license quota normally 100, configured by Synconix.
• 20 active keys per account, 20 source IP/CIDR entries per key.
• Key expiry 1–365 days or Unlimited (no expiry); installation token expiry remains 60 minutes. Unlimited keys remain IP-restricted, count toward the active-key limit and can be revoked immediately.

Use bounded backoff and avoid polling every license individually. Creation retries must retain the exact request payload and Idempotency-Key.

Operational security

• Use a dedicated read-only key for monitoring and a separate narrowly restricted Manage key for provisioning.
• Keep secrets server-side; redact Authorization headers, install URLs and commands from logs.
• Never disable TLS verification or rely on client-provided forwarding headers to bypass an IP restriction.
• Rotate keys with overlap, test the replacement, then explicitly revoke the old key.
• Report the environment, UTC time, endpoint, HTTP status, order/license reference and X-Request-ID when available. Never send the secret to support.

API requests are audited with key identifier, path, method, source IP and response status; request bodies and bearer secrets are not stored in that audit.