# HTTP API

> The HTTP API behind the netweft dashboard: where its OpenAPI document lives, how requests authenticate, how errors are shaped, and its rate limits.

Source: https://netweft.com/docs/http-api
Updated: 2026-10-15

**Every dashboard screen runs on a documented HTTP API at https://api.netweft.com, described by an OpenAPI 3.1 document. It authenticates with a signed-in session; agents should use the MCP server instead.**

The netweft dashboard runs entirely on an HTTP API at
`https://api.netweft.com`. The API describes itself in an OpenAPI 3.1
document, generated from the same schemas that validate every request and
response:

```text
https://api.netweft.com/openapi.json
```

## Authentication

The HTTP routes authenticate with the session cookie that signing in to the
dashboard sets. They do not accept API keys, and the API refuses state-changing
requests sent from another site.

| What you want | Use |
| --- | --- |
| An agent or script that reads a workspace | the [MCP server](/docs/mcp-server) with an [API key](/docs/api-keys) |
| Everything else, including paid lookups | the dashboard |

## Errors

A failed request answers with a named problem:

```json
{ "code": "limit_audits_per_month", "error": "This plan allows 60 audits a month" }
```

`code` is stable and is what a client should branch on; `error` is a sentence
for a person and may change. Each code maps to one HTTP status:

| Status | Codes |
| --- | --- |
| 401 | `unauthenticated` |
| 402 | `insufficient_credits` |
| 403 | `insufficient_role`, `no_subscription`, `limit_*`, `demo_read_only` |
| 404 | `not_found` |
| 409 | `already_running`, `project_archived` |
| 422 | `validation_failed`, with `issues` when a schema refused the input |
| 428 | `not_connected`, `missing_scope` (Google) |
| 429 | `rate_limited` |
| 503 | `vendor_unavailable` |

## Rate limits

| Limit | Applies to |
| --- | --- |
| 60 paid requests a minute | a workspace on a paid plan |
| 10 paid requests a minute | a workspace on a free trial |
| 120 requests a minute | one API key on the MCP server |

Limits are counted per Cloudflare location, so they hold approximately.

## Health

`GET https://api.netweft.com/health` needs no authentication and reports
whether the database and cache are up.