Limits and Errors
The API is free and shared, so it limits how much each client can ask for. Plan for these limits from the start, and your script will run without interruptions.
Request limits
Each client address has an allowance per minute. Search and node images cost more to answer, so they have lower limits, counted separately from the rest:
| Requests | Per minute |
|---|---|
Search (/api/search) | 30 |
Node images (…/image) | 20 |
| All other endpoints | 60 |
The API page always shows the current limits. Every answer tells you where you stand, in these headers:
X-RateLimit-Limit— how many requests you may send in the current period.X-RateLimit-Remaining— how many of them are left.X-RateLimit-Reset— the seconds until your allowance is full again.
When you go over the limit, the API answers with status 429 and a Retry-After header that says how many seconds to wait. A script should wait that long instead of trying again right away. Cache what you fetch, as nodes change rarely, and do not crawl the whole catalog. If you plan something big, get in touch and we will find a way.
Errors
Apart from 429, these are the errors you can get:
| Status | Meaning |
|---|---|
400 | A parameter has a value the endpoint does not accept; the message says which one |
401 | You sent credentials, and they are wrong (see Signing in) |
404 | No item has this ID, or it does not exist in the KNIME version you asked for |
406 | A node image was requested without saying which format (see Node Images) |
Calling the API from a web page
Call the API from your servers, scripts, and tools, not from a visitor’s browser. Most endpoints do not answer pages on other websites at all. The few that do, such as the search, allow it for NodePit Runner’s web interface, and may stop. If you build a web application, let your own backend fetch the data and pass it on.
The OpenAPI document is the exception: scripts on other sites may always read it, so that online tools can load it.
Signing in
You do not need to sign in. If you want to send your NodePit account with a request anyway, use HTTP Basic authentication with your username and password. Credentials that are wrong get a 401 instead of an answer, even for data that is public, so only send them if you mean to. After ten wrong attempts within 15 minutes, the API stops answering requests with credentials from that address until the 15 minutes are over.