API reference

Error codes

Every error response is JSON with a detail field describing the cause + an x-trace-id header you can cite in a support ticket.

Status codes

StatusReasonWhen
400Bad requestValidation error in body — see detail.
401UnauthorizedMissing/malformed/unknown/revoked API key.
403ForbiddenAPI key lacks required scope.
404Not foundScan does not exist or belongs to a different tenant.
409ConflictBOM requested before scan reached `completed`.
429Rate limitedPer-tenant ceiling exceeded — retry after `Retry-After` seconds.
500InternalUnexpected error — please report to partners@qortrace.com with the response `x-trace-id`.

Example error response

{
  "detail":  "API key 'qb_live_abc...' has been revoked.",
  "code":    "key_revoked",
  "x-trace-id": "trc_8f2a1c0b9d3e"
}

Rate limits

Default partner tier: 60 scans/hour + 120 BOM downloads/hour. Enterprise tiers are higher — talk to your account contact to raise the ceiling.

Headers on every response. X-QorBOM-RateLimit-Limit, X-QorBOM-RateLimit-Remaining, X-QorBOM-RateLimit-Reset. On a 429 you'll also get Retry-After.

Reporting a 500

If you see a 500, email partners@qortrace.com with:

  • The full x-trace-id header value
  • The exact request method + path
  • Your tenant ID (visible in the response body as tenant_id)

We'll have a root-cause in your inbox within 1 business day on sandbox keys, 1 business hour on production keys.