> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tumban.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Base URL, authentication, content type, and error envelope.

## Base URL

```
https://api-v2.tumban.com
```

All v2 endpoints are mounted under `/api/v2`.

## Authentication

Every request requires an `Authorization: Bearer <token>` header.

```http theme={null}
Authorization: Bearer sk_<64-hex-string>
```

See [Authentication](/authentication) for the full description.

## Content type

Request and response bodies are JSON. Send
`Content-Type: application/json` on `POST` and `PATCH`.

## Error envelope

Errors return a JSON object with a `detail` field:

```json theme={null}
{ "detail": "Invalid or revoked API key" }
```

Validation errors (HTTP 422) return a list under `detail`. Each entry
has `loc` (an array of segments locating the offending field), `msg`,
`type`, and may include `input`, `ctx`, and `url`.

```json theme={null}
{
  "detail": [
    {
      "loc": ["body", "profile_url"],
      "msg": "Input should be a valid URL",
      "type": "url_parsing",
      "input": "not-a-url"
    }
  ]
}
```

See [Errors](/api/errors) for the status-code reference.

## Async processing

Endpoints that submit work (`/scan/deep`, `/scan/quick`, `/batch/deep`,
`/batch/quick`) return immediately with a status of `processing` and an
estimated completion time. The final result is delivered either by
webhook to your `callback_url` or by polling
[`GET /api/v2/scans/{scan_id}`](/api/scans/get).

## Tenancy

Every request is scoped to the organization that owns the credential.
You cannot read or list resources from another organization.

## Rate limits

Tumban enforces a per-organization **daily scan limit** when one is
configured for your org. Scan-submission endpoints
([Create scan](/api/scans/create), [Create batch](/api/scans/batch))
return `429` with a structured `detail` body when the limit is hit:

```json theme={null}
{
  "detail": {
    "error": "daily_scan_limit_exceeded",
    "limit": 1000,
    "used": 1000
  }
}
```

The counter resets at `00:00 UTC`. [Create batch](/api/scans/batch) has
a partial-acceptance path — see its docs.

Tumban does **not** return `X-RateLimit-*` headers, and it does **not**
honour an `Idempotency-Key` header. Treat your `scan_id` (or per-profile
`scan_id`s in a batch) as the natural idempotency key in your own
handler.