Essentially I am trying to query the NIST API using a CPE, to collect all the vulnerabilities about that CPE using python. The nist documentation says if you have an api key (which i do) you get 100 requests in a rolling 60 second window, but when i only make 24 requests using aiohttp, asyncrnously i get a 403 forbidden error, with the text stating Request forbidden by administrative rules. The documentation also states you should "sleep" your scripts for six seconds between requests. So my question is how many requests should i send as those statements seem to be contradicting one another. And why am i getting this error ?
The public rate limit is 5 requests in a rolling 30 second window. That means you need to have a sleep time of 6 secs between requests.
In the case you have an API key, you are allowed to make 50 requests in a rolling 30 second window. That is approx. 2 requests per second without needing to sleep. If you plan to make more requests in the allowed 30 second window, then you may have to implement an appropriate sleep time.
Rate limits for NIST API