API & endpoints
Errors, limits, and what a call costs
Status codes, plan rejections, rate limits, and how audits draw on your weekly allowance and credits — including when a failed run is refunded.
Last updated 2026-08-08
Transport status codes
| Status | Meaning | What to do |
|---|---|---|
401 | Missing or invalid bearer token. | Check the header. Read WWW-Authenticate for where to authenticate. |
204 | CORS preflight succeeded. | Nothing — this is OPTIONS. |
429 | Rate limited. | Honour Retry-After. |
200 | JSON-RPC responded. | The call may still have failed — see below. |
200 does not mean it worked
A tool that refuses still returns 200. JSON-RPC reports transport success; the refusal is in the body. Never treat a 200 as "the audit ran" — parse the result.
Refusals in the body
Three you should handle explicitly:
- `plan_required` — the tool is above the account's plan. The message names the required plan and the upgrade URL. Returned by
fix_app,submit_directoriesandmonitor_ai_visibility. - Weekly limit reached — the allowance is spent and usage credits are off or empty. Turn on usage credits or top up.
- Gate errors — the URL failed admission: unparseable, a blocked host, or over the plan's app limit.
What a call costs
Audits are metered against a weekly allowance first, then pay-as-you-go credits. Read-only tools cost nothing.
| Action | Charged | Free |
|---|---|---|
scan_app | Yes — single-page audit | |
audit_app | Yes — deep crawl, the most expensive action | |
fix_app | Yes — pull request run | |
monitor_ai_visibility | Yes — one probe set | |
get_scan, get_audit, list_apps, scan_history, explain_check, get_account | Free |
A run that fails is refunded. If scan_app ends in an error the charge is returned automatically, and a cancelled or failed deep audit unwinds its charge from the stash held on the run — you are not billed for work that produced nothing.
Rate limits
Limits are per-account and generous for normal use; the deep-audit page budget is set by your plan rather than by a request cap. If you are driving Actuant in a loop, poll get_audit at a couple of seconds, not continuously — a crawl takes minutes and nothing changes between polls faster than that.
Keep reading
Calling it with curl
The Actuant MCP endpoint is JSON-RPC 2.0 over HTTP POST. Initialize, list tools, call a tool — with the exact headers and payloads, and the header everyone forgets.
Deterministic scoring
Actuant's launch-readiness score is a pure function of what's on your page — the same URL always yields the same number. Learn why the model narrates but never scores.
API overview
What Actuant exposes over HTTP: an MCP server for programmatic use, a set of public endpoints that need no auth, and dashboard-only routes that will reject an API key.