API reference
Error codes
Every error response is JSON with a detail field describing the cause + an x-trace-id header you can cite in a support ticket.
Status codes
| Status | Reason | When |
|---|---|---|
| 400 | Bad request | Validation error in body — see detail. |
| 401 | Unauthorized | Missing/malformed/unknown/revoked API key. |
| 403 | Forbidden | API key lacks required scope. |
| 404 | Not found | Scan does not exist or belongs to a different tenant. |
| 409 | Conflict | BOM requested before scan reached `completed`. |
| 429 | Rate limited | Per-tenant ceiling exceeded — retry after `Retry-After` seconds. |
| 500 | Internal | Unexpected error — please report to partners@qortrace.com with the response `x-trace-id`. |
Example error response
{
"detail": "API key 'qb_live_abc...' has been revoked.",
"code": "key_revoked",
"x-trace-id": "trc_8f2a1c0b9d3e"
}Rate limits
Default partner tier: 60 scans/hour + 120 BOM downloads/hour. Enterprise tiers are higher — talk to your account contact to raise the ceiling.
Headers on every response.
X-QorBOM-RateLimit-Limit, X-QorBOM-RateLimit-Remaining, X-QorBOM-RateLimit-Reset. On a 429 you'll also get Retry-After.Reporting a 500
If you see a 500, email partners@qortrace.com with:
- The full
x-trace-idheader value - The exact request method + path
- Your tenant ID (visible in the response body as
tenant_id)
We'll have a root-cause in your inbox within 1 business day on sandbox keys, 1 business hour on production keys.