FAQ and troubleshooting
Resolve API errors, missing data, key issues and billing questions.
Why do I receive 401?
Supply Authorization: Bearer YOUR_API_KEY on keyed endpoints. Check for whitespace, an expired key, revocation or a key replaced by rotation. A Console session does not authenticate an API-key endpoint. Sign in again for session-based Console tools. Ask an owner or admin to manage keys in API keys.
Why do I receive 403?
Authentication succeeded but the plan, scope or role is insufficient. Public and Researcher keys cannot read event rows. Professional and Enterprise include events; exports require Enterprise. Firewall feeds also need organization-bound keys and a current organization entitlement. Only owners and admins can manage keys, members, billing and allowlist settings; Activity also requires one of those roles. Check the active workspace in Console.
Why do I receive 429?
A per-minute or daily request/row quota was reached. Honor Retry-After, use exponential backoff, reduce polling and avoid fetching completed windows repeatedly. Daily usage is measured in UTC. Read the rate and daily limit headers. A new key is not a reason to evade a quota; check usage and choose appropriate access with your organization owner.
Why is data delayed or missing?
Public samples and Researcher sample access are delayed at least 60 minutes. Professional events are delayed at least 15 minutes; Enterprise has no minimum event delay. Time filters are clamped to accessible history and delay. Check UTC timestamps, category and protocol filters before widening the window. Withheld public cells are not zero. An empty result or not-seen lookup means unknown, never safe.
Why is there less history than my plan allows?
The network has collected since 2026-11-01, so history is still filling. Professional permits 30-day event history and Enterprise 365 days; neither creates older observations. Lookup is capped at 30 days even on Enterprise. Keep the actual observation window beside any chart or report.
How do I rotate a key?
An owner or admin opens API keys, rotates the key, copies the newly shown secret and updates every collector using it. The previous key stops working. Plan a coordinated cutover; never paste keys into tickets, examples or SIEM searches. Revoke keys that are no longer needed. See the quickstart.
How do plan changes work?
Owners and admins use Billing. Checkout return alone does not grant access: payment confirmation updates the subscription and organization entitlement. Organization keys synchronize to the effective plan. A canceled subscription retains paid access until period end when cancellation is scheduled that way. After paid access ends, the underlying free entitlement remains. If access does not match the confirmed subscription, contact support.
What is the founding offer?
Professional list pricing is $299/month or $2,990/year. The first 50 organizations can subscribe for $199/month or $1,990/year and retain that price while subscribed. Availability is shown in Billing; a place is not guaranteed by reading this page. Enterprise starts at $12,000/year. Prices include tax. Public and approved Researcher access are free; there is no free trial.
Can I get a refund?
Monthly payments and renewals are non-refundable. The first annual payment is refundable in full when requested within 14 days. An organization owner should contact support. The operator handles refunds; refunding an invoice does not itself cancel the subscription. Use the billing portal for cancellation and coordinate any eligible refund with support. See the terms.
Can I reuse or train on the data?
The public 1-in-100 sample is CC BY 4.0. Published aggregates and charts may be quoted or cited with attribution; they are not CC BY-licensed. Event-level data, streams, the full dataset and training exports are proprietary. API access does not grant redistribution or training rights. Consult research guidance and the data access page.
Where can I get help?
Use Contact for support, access and licensing questions. Include endpoint path, HTTP status, UTC time and a sanitized description of the issue. Remove API keys, personal data and private event evidence. For setup, start with the Console guide and API reference.