Back
Reseller & API

Response format, errors, rate limits and scopes

The standard success {data} and error {errors:[{code,status,detail}]} envelopes, common HTTP status codes, the 240 req/min rate limit, and how key scopes restrict access.

errorsresponsesrate limitscopesstatus codes

The Reseller API uses one predictable envelope for every response, so you can parse success and failure the same way across all endpoints.

Success responses

Successful responses return a top-level data field. It is an object for a single resource and an array for collections.

json
{
  "data": {
    "id": "svc_8fj2k",
    "category": "vps",
    "status": "running"
  }
}

Error responses

Errors return a top-level errors array. Each entry has a machine-readable code, the HTTP status, and a human-readable detail.

json
{
  "errors": [
    {
      "code": "insufficient_credits",
      "status": "402",
      "detail": "Your credit balance is too low to provision this plan."
    }
  ]
}

Common status codes

StatusMeaningWhat to do
200 / 201SuccessRead the data field.
202AcceptedAction is queued (e.g. provision, reinstall). Poll the service or wait for a webhook.
400Bad requestFix the request body / parameters.
401UnauthorizedMissing or invalid Bearer key.
403ForbiddenYour key lacks the required scope.
404Not foundUnknown service id or catalog code.
402Payment requiredTop up credits, then retry.
422Validation errorA field failed validation — see detail.
429Rate limitedBack off and retry after the reset window.
5xxServer errorRetry with backoff; check status.victuscloud.com.

Rate limits

The default limit is 240 requests per minute per key. When you exceed it you get a 429 response. Inspect the rate-limit headers to pace your requests instead of retrying blindly.

text
X-RateLimit-Limit: 240
X-RateLimit-Remaining: 0
Retry-After: 12

Handle 429 gracefully

Respect the Retry-After header (seconds) and use exponential backoff. Batch or cache catalog reads instead of calling GET /catalog on every page load.

Scopes

Each key can be restricted to a set of scopes when you mint it, so a key only does what it needs. A call that requires a scope the key lacks returns 403.

  • read — read account, catalog, regions and services (GET endpoints).
  • provision — create new services (POST /services).
  • manage — power, console, reinstall, resize, suspend/unsuspend, backups, reset-password.
  • terminate — delete services (DELETE /services/{id}).
  • webhooks — read and update webhook configuration.

Least privilege

Give a read-only key to a public status dashboard and reserve provision/terminate scopes for your trusted backend. This limits the blast radius if any single key leaks.

Related in Reseller & API

Reseller API overview (sell VPS, game, bot and app hosting under your brand)What the Victus Reseller API is, what you can sell with it, and how the prepaid credit model works so you can build your own storefront on top of Victus infrastructure.Get an API key and understand the prepaid credit modelMint a reseller API key (rslr_...) from the Reseller API page in the Victus panel, store it safely, and top up the prepaid credit balance the API spends.Authentication and base URLThe Reseller API base URL, how to send your rslr_ bearer token, required headers, and a quick authenticated request to confirm your key works.List the catalog, plans and regionsRead the available product categories, plans and pricing with GET /catalog, drill into a specific plan code, and list deployment regions with GET /regions.Provision a service (VPS, game, bot and app examples)Create services with POST /services for every category — full curl examples for a VPS, a Minecraft game server, a Discord bot and an app, plus how to poll until it is ready.Manage a service (power, console, usage, lifecycle, backups)Control a provisioned service: power signals, console access, usage stats, suspend/unsuspend, reinstall, resize, reset-password, backups and termination.List services, get a single service, and check your balanceUse GET /services to list everything you have provisioned, GET /services/{id} for one service, GET /account for your credit balance, and GET /account/transactions for the ledger.Webhooks (events and X-Victus-Signature HMAC verification)Register a webhook endpoint with PUT /webhooks, receive service and billing events, and verify every delivery with the X-Victus-Signature HMAC header.