Victus Cloud / Support
RESELLER & API

Response format, errors, rate limits and scopes

The standard success {data} and error {errors:[{code,status,detail}]} envelopes, common HTTP status codes, the 240 req/min rate limit, and how key scopes restrict access.

The Reseller API uses one predictable envelope for every response, so you can parse success and failure the same way across all endpoints.

Success responses

Successful responses return a top-level data field. It is an object for a single resource and an array for collections.

{
  "data": {
    "id": "svc_8fj2k",
    "category": "vps",
    "status": "running"
  }
}

Error responses

Errors return a top-level errors array. Each entry has a machine-readable code, the HTTP status, and a human-readable detail.

{
  "errors": [
    {
      "code": "insufficient_credits",
      "status": "402",
      "detail": "Your credit balance is too low to provision this plan."
    }
  ]
}

Common status codes

StatusMeaningWhat to do
200 / 201SuccessRead the data field.
202AcceptedAction is queued (e.g. provision, reinstall). Poll the service or wait for a webhook.
400Bad requestFix the request body / parameters.
401UnauthorizedMissing or invalid Bearer key.
403ForbiddenYour key lacks the required scope.
404Not foundUnknown service id or catalog code.
402Payment requiredTop up credits, then retry.
422Validation errorA field failed validation — see detail.
429Rate limitedBack off and retry after the reset window.
5xxServer errorRetry with backoff; check status.victuscloud.com.

Rate limits

The default limit is 240 requests per minute per key. When you exceed it you get a 429 response. Inspect the rate-limit headers to pace your requests instead of retrying blindly.

X-RateLimit-Limit: 240
X-RateLimit-Remaining: 0
Retry-After: 12
Handle 429 gracefully

Respect the Retry-After header (seconds) and use exponential backoff. Batch or cache catalog reads instead of calling GET /catalog on every page load.

Scopes

Each key can be restricted to a set of scopes when you mint it, so a key only does what it needs. A call that requires a scope the key lacks returns 403.

  • read — read account, catalog, regions and services (GET endpoints).
  • provision — create new services (POST /services).
  • manage — power, console, reinstall, resize, suspend/unsuspend, backups, reset-password.
  • terminate — delete services (DELETE /services/{id}).
  • webhooks — read and update webhook configuration.
Least privilege

Give a read-only key to a public status dashboard and reserve provision/terminate scopes for your trusted backend. This limits the blast radius if any single key leaks.

Was this article helpful?

Still stuck?

Our team can help with your account or service.

Open a ticket →