Vault DLP export gates
A whole-folder read or export=true search trips a daily-quota + 2FA step-up gate before the read even runs — by design, not a bug.
Bulk-reading the whole vault is exactly how a hijacked or idle session mass-dumps a fanbase's content, so two vault reads are gated before they're allowed to run at all — not after.
What trips the gate
| Endpoint | Gated when |
|---|---|
GET /vault/search | Only when called with export=true (an explicit bulk pull). The normal interactive search — the default limit=200 panel read — is ungated. |
GET /vault/folder/{folder_id} | Always. A full-folder dump is inherently the "enumerate everything" shape, so there's no ungated variant. |
What the gate actually checks, in order
- Quota. Today's export count and row count for your workspace are compared against a daily
ceiling (10 exports / 50,000 rows by default). Over budget →
429 export_quota_exceeded. - Step-up 2FA — 2FA users only. If your account has TOTP enabled, the call needs a fresh
codequery parameter (a TOTP code or an unused backup code) — the same verification the login challenge uses. Missing or wrong →401 twofa_required. A non-2FA caller (the legacy owner, an API key, or a creator who never turned on 2FA) has no factor to present, so step-up is skipped for them entirely — quota and audit logging still apply. - Audit, always. Every decision — allowed or denied — writes a tamper-evident audit row. Allowed pulls also bump the daily usage ledger.
curl "https://app.tease.link/api/admin/vault/search?q=&export=true&code=482913" \
-H "Authorization: Bearer $TEASE_API_KEY"This is intentional, not a rate-limit bug
A 429/401 here on a bulk pull is the DLP control layer doing its job — it runs before
any data streams, so a rejected call fails cleanly with no partial dump. It is never accidental
and there is no workaround short of waiting for the quota to reset or presenting a valid 2FA
code.
What's next
For the OnlyFans-write side of vault operations (a different kind of "why did this stall"), see Async engine write gotchas.
When an empty block misreads its own cause
Collapsing four distinct empty reasons into one generic message has caused a real incident — here's what to check before you trust a block's explanation.
A strong-subs source with weak revenue
Why one traffic source can show a healthy subscriber count and still trail sources with far fewer subs — and which number actually tells you the source is working.