API
Errors and limits
Error shape, the codes you will actually hit, and what is rate limited.
Availability note — these docs describe both working and planned product areas. Account authentication, administrator-managed AIHK/AICA tenant regions and keys, signed-in Composer runs and public Guard scans are connected. Skills, Memory, Agents, Workflows, Apps, billing, the public SDK/CLI and the unified API are previews unless a section explicitly says otherwise.
{
"error": "invalid_input",
"message": "Human-readable explanation."
}| Status | Code | What to do |
|---|---|---|
| 400 | invalid_json / invalid_input | Send a JSON object containing only fields accepted by that route. |
| 401 | unauthenticated / invalid_api_key | Send a valid gc_session cookie or a non-expired key carrying the route's required scope. |
| 403 | bad_origin / forbidden / tenant_* | Use the same origin and an account with the required role and active tenant. |
| 404 | not_found / repository_unavailable | The requested record is absent, or Guard cannot access the requested public repository. |
| 409 | already_* / tenant_ai_* | Resolve the current tenant AI key or gateway lifecycle conflict first. |
| 413 | body_too_large / remote_response_too_large | Reduce the workspace JSON body or Guard collection input. |
| 422 | no_scannable_content | Supply readable source or manifest content; Guard does not score zero-file collections. |
| 429 | rate_limited | Back off; some auth responses include Retry-After. |
| 500 | workspace_unavailable | The server could not safely read or write workspace storage. |
| 502 / 504 | remote_* | GitHub collection failed within Guard's network safety boundary. |
| 503 | tenant_ai_disabled / tenant_ai_not_ready | Assign the tenant gateway and provision one ready key with chat enabled. |
Limits
- Workspace JSON bodies are capped at 140 KB and reject unsupported top-level fields.
- Guard scans are limited to 12/minute publicly, 60/minute per signed-in account and 120/minute per API key.
- Guard analyses at most 40 files, 96 KB per file and 1.5 MB of collected content; GitHub collection has a 20-second overall deadline.
- Composer accepts up to 16,000 prompt characters and 4,000 system characters, with 20 runs/minute per signed-in account or API key.