Response format, errors, rate limits and scopes
The standard success {data} and error {errors:[{code,status,detail}]} envelopes, common HTTP status codes, the 240 req/min rate limit, and how key scopes restrict access.
The Reseller API uses one predictable envelope for every response, so you can parse success and failure the same way across all endpoints.
Success responses
Successful responses return a top-level data field. It is an object for a single resource and an array for collections.
Error responses
Errors return a top-level errors array. Each entry has a machine-readable code, the HTTP status, and a human-readable detail.
Common status codes
| Status | Meaning | What to do |
|---|---|---|
| 200 / 201 | Success | Read the data field. |
| 202 | Accepted | Action is queued (e.g. provision, reinstall). Poll the service or wait for a webhook. |
| 400 | Bad request | Fix the request body / parameters. |
| 401 | Unauthorized | Missing or invalid Bearer key. |
| 403 | Forbidden | Your key lacks the required scope. |
| 404 | Not found | Unknown service id or catalog code. |
| 402 | Payment required | Top up credits, then retry. |
| 422 | Validation error | A field failed validation — see detail. |
| 429 | Rate limited | Back off and retry after the reset window. |
| 5xx | Server error | Retry with backoff; check status.victuscloud.com. |
Rate limits
The default limit is 240 requests per minute per key. When you exceed it you get a 429 response. Inspect the rate-limit headers to pace your requests instead of retrying blindly.
Handle 429 gracefully
Respect the Retry-After header (seconds) and use exponential backoff. Batch or cache catalog reads instead of calling GET /catalog on every page load.
Scopes
Each key can be restricted to a set of scopes when you mint it, so a key only does what it needs. A call that requires a scope the key lacks returns 403.
- read — read account, catalog, regions and services (
GETendpoints). - provision — create new services (
POST /services). - manage — power, console, reinstall, resize, suspend/unsuspend, backups, reset-password.
- terminate — delete services (
DELETE /services/{id}). - webhooks — read and update webhook configuration.
Least privilege
Give a read-only key to a public status dashboard and reserve provision/terminate scopes for your trusted backend. This limits the blast radius if any single key leaks.