Developer API Terms

1. Scope and how this relates to the AskBiz Terms of Service

These Developer API Terms (“API Terms”) are a supplement to, and form part of, the AskBiz Terms of Service. They apply specifically to your registration for API keys, your use of any endpoint under /api/v1/*, and your use of the developer.askbiz.co dashboard (keys, apps, webhooks, usage, console). The general AskBiz Terms of Service, Acceptable Use Policy, and Prohibited Activities Policy continue to apply to your account as a whole. Where these API Terms are silent, the general Terms of Service govern; where they conflict on a matter specific to the API or developer platform, these API Terms govern.

By generating an API key, calling any /api/v1/* endpoint, or using the developer.askbiz.co dashboard, you accept these API Terms on behalf of yourself or, if you are acting for an organization, on behalf of that organization — in which case “you” means that organization and you confirm you have authority to bind it.

2. Definitions

• “API” means the AskBiz REST API served under /api/v1/*, documented at developer.askbiz.co/docs.
• “API Key” means a credential of the form abz_live_… (a Live Key, which can move real money and send real messages) or abz_test_… (a Test Key, restricted to simulated responses on billed and messaging endpoints) issued to you for authenticating requests.
• “Application” or “App” means software you build that calls the API, optionally grouped under a named App in the dashboard.
• “Merchant” means an AskBiz business account holder whose data your Application may request scoped access to.
• “Connection” means a scoped grant of access to a specific Merchant’s account, created via POST /api/v1/connections and approved by the Merchant on a hosted consent page.
• “Scopes” means the specific permissions (for example read_inventory) requested in a Connection and shown to the Merchant before they approve it.
• “you” / “your” means the developer or organization registered to use the API. “we” / “us” / “AskBiz” means AskBiz Ltd.

3. Eligibility and your account

You must be able to form a binding contract to accept these API Terms — either as an adult acting for yourself, or as someone with actual authority to bind the organization you represent. Registration information you give us (including any email or phone number tied to your account) must be accurate, and you’re responsible for keeping it current. Developer accounts run on the same underlying AskBiz account system as the rest of the platform — see the AskBiz Terms of Service for the account-level rules (one account per person/entity absent a separate agreement, suspension for fraud, and so on).

4. API keys and credentials

Your API Key is a credential, not a public identifier. You are responsible for every request made with it, whether or not you made the request yourself. In particular:

• Don’t embed a key in client-side code, a mobile app binary, a public repository, or anywhere else an end user or search engine could extract it. Keys are meant to be held server-side.
• Don’t share a key between unrelated parties, or let a key stand in for its own authentication system for your end users.
• If a key is exposed or you suspect misuse, disable it immediately from the Keys page in your dashboard and issue a new one — there is no key-rotation feature, so disabling and replacing is the correct response.
• We may disable a key without notice where we reasonably believe it has been compromised, is being used to violate these API Terms, or presents a security risk to AskBiz, a Merchant, or another user — see Authentication for what a disabled key returns.

Keys are issued in account or generic mode, which changes what certain endpoints do with a request — see Authentication for the distinction. You may optionally group keys under a named App (name, logo, redirect URI) purely for organization and so Merchants see a recognizable name and logo on the consent screen instead of an unbranded request — see Organize keys with Apps.

5. Acceptable use

Your use of the API is subject to the general AskBiz Acceptable Use Policy and Prohibited Activities Policy, both incorporated here by reference. In addition, specifically for API and developer-platform use, you must not:

• Attempt to circumvent a rate limit or quota — including by registering multiple keys or accounts to evade a limit that applies to you.
• Scrape, bulk-extract, or systematically republish the documentation, pricing, or OpenAPI spec in a way that misrepresents it as your own or that isn’t reasonable programmatic use (fetching GET /api/v1/pricing or /api/v1/openapi.json to drive your own integration is exactly what they’re for).
• Reverse-engineer, decompile, or attempt to extract the underlying models behind /api/v1/scan or /api/v1/ask, or use API responses to train a directly competing product recognition or business-intelligence model.
• Represent your Application as an official AskBiz product, or represent yourself as AskBiz, when communicating with a Merchant or end user.
• Use /api/v1/whatsapp/send to send a message to a recipient who hasn’t consented to receive it, or otherwise in a way that would violate WhatsApp’s own Business Messaging Policy — you’re sending through AskBiz’s Meta Business API connection, and messaging abuse risks that connection for every developer using it, not just you.
• Submit content through /api/v1/scan or /api/v1/ask that you don’t have the right to submit, or that is unlawful, infringing, or contains another person’s sensitive personal data without a lawful basis.

We may suspend the specific key or Connection involved, rather than your whole account, where that’s a proportionate response to a violation.

6. Merchant connections and scoped access

POST /api/v1/connections lets you request persistent, scoped access to a specific Merchant’s account. Access only exists once that Merchant has approved it on AskBiz’s own hosted consent page, which shows them exactly which Scopes you requested and, where your key is grouped under an App, your App’s name and logo. You may not:

• Request Scopes broader than what your Application actually needs.
• Use data obtained through a Connection for any purpose beyond what was disclosed to the Merchant at the time they approved it.
• Attempt to access Merchant data outside the Scopes actually granted — for example, calling an endpoint with a merchant_id your Connection doesn’t have the matching Scope for.
• Continue using previously obtained data, or make further calls against a Connection, once that Merchant has revoked it. Revocation is immediate and effective on our side; you’re responsible for stopping use of anything you already retrieved beyond what’s reasonably necessary to wind down (for example, honoring an in-flight refund).

A Merchant can revoke a Connection at any time from their own AskBiz account. We are not a party to, and don’t mediate, the substantive relationship between you and a Merchant — we provide the consent and access-control mechanism; the terms of your actual dealings with a Merchant are between you and them.

7. Billing-on-behalf-of (Charges)

POST /api/v1/charges lets you create a charge request against a Merchant, collected through a hosted Stripe Checkout page — no card details ever touch your servers or ours. When you use this endpoint:

• You are responsible for the accuracy of every amount and description you submit. A Merchant sees exactly what you sent before they pay.
• AskBiz acts as a billing facilitator between you and the Merchant, using Stripe as the underlying payment processor. We are not a party to whatever underlying product, service, or subscription the charge relates to — that arrangement is between you and the Merchant.
• You must not create a charge request the Merchant hasn’t agreed to, or duplicate a charge for something already paid. Combined with Idempotency-Key on other endpoints, this is why /api/v1/charges deserves extra care in your own retry logic even though the endpoint itself doesn’t support an Idempotency-Key today — see Authentication for which endpoints do.
• Refunds and payment disputes are handled per Stripe’s own terms for the underlying transaction. For a dispute you can’t resolve directly with the Merchant, contact hello@askbiz.co.

8. Fees and billing for your use of the API

Billed endpoints are charged only on success — a failed or rejected call is never charged. Current prices are always published, without authentication required, at GET /api/v1/pricing; that live endpoint is the authoritative source of pricing, and takes precedence over any price mentioned in these Terms, the docs prose, or other marketing material if the two ever drift apart.

Calls are debited against a prepaid credit balance (“wallet”). A 200 response that pushes your balance below the low-balance threshold includes low_balance_warning: true and your current balance_cents in-band, so you find out at the moment it happens rather than only when a later call fails with a 402. Once your balance is insufficient, billed endpoints return a 402 with the amount needed and a top-up link.

Where we make a material change to pricing that affects an endpoint you’re actively using, we’ll record it in the Changelog and make reasonable efforts to notify active developers by email in advance of it taking effect. You’re responsible for any taxes applicable to your use of the API in your own jurisdiction.

9. Rate limits, quotas, and fair use

Your plan sets a per-minute rate limit and, on some plans, a monthly quota — see Authentication for the current numbers and how the limit is enforced. Regardless of your plan’s stated limit, we may throttle or temporarily suspend a key whose traffic pattern threatens the stability of the API for other developers, and we’ll make reasonable efforts to tell you why if that happens.

10. Idempotency

/api/v1/scan and /api/v1/whatsapp/send support an Idempotency-Key header, described in full on the Authentication page. Reusing the same idempotency key value for two different request bodies is undefined behavior — you’ll get back whichever response was stored against that key first, not a response to your second request. Generate a fresh key per logical operation (for example, per unique order or message), not a fixed constant.

11. Availability, changes, and versioning

The API is provided on an “as available” basis. We don’t commit to a specific uptime percentage under these API Terms absent a separate, signed enterprise agreement that says otherwise. We will make reasonable efforts to give advance notice of planned maintenance and of any breaking change to an endpoint you’re using — in practice, via the Changelog and, where we have a way to reach you, by email.

The API is path-versioned (/api/v1/*). We may add new endpoints, new optional request fields, or new optional response fields at any time without notice — code that ignores fields it doesn’t recognize won’t break. For a change that removes or changes the meaning of an existing field or endpoint, we intend to give at least 90 days’ notice via the Changelog before it takes effect, except where an immediate change is required for security or legal reasons.

12. Intellectual property

AskBiz owns all right, title, and interest in the API, the documentation, the OpenAPI specification, and the underlying models and infrastructure. Subject to your compliance with these API Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to access and call the API to build and operate your own Application. You retain all rights in your own Application and in content you submit through it, subject to the license you grant us to process that content in order to return a response to you (for example, an image submitted to /api/v1/scan is processed to generate a match result).

13. Confidentiality

Each party will use the other’s confidential information (including, on our side, non-public API behavior, and on your side, your Application’s non-public design) only as needed to perform under these API Terms, and won’t disclose it to third parties except to the extent already public, independently developed, rightfully received from someone else, or required to be disclosed by law.

14. Data protection

How we handle personal data in connection with the API — your data as a developer, and Merchant data accessed through a Connection — is set out in the Developer Privacy Addendum, which supplements the AskBiz Privacy Policy. If your Application processes personal data on behalf of a Merchant or their customers, you are responsible for having your own lawful basis and your own compliant privacy notice for that processing — see Section 12 of the Developer Privacy Addendum. A data processing agreement is available at askbiz.co/dpa where one is required for your use case.

15. Suspension and termination

You may stop using the API at any time by disabling your keys. We may suspend or terminate your API access — a specific key, a specific Connection, or your developer account as a whole, depending on what’s proportionate — where we reasonably believe you’ve violated these API Terms, the Acceptable Use Policy, or the Prohibited Activities Policy; where required by law; to prevent harm to AskBiz, a Merchant, or another user; or for non-payment of fees owed. Where practical, we’ll tell you why. Sections that by their nature should survive termination — including Intellectual Property, Confidentiality, Data Protection, Warranties and Disclaimers, Limitation of Liability, Indemnification, and Governing Law — do survive.

16. Warranties and disclaimers

The API is provided “as is” and “as available.” To the fullest extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We don’t warrant that the API will be uninterrupted, error-free, or that results from /api/v1/scan or /api/v1/ask will be accurate or complete for your purposes — you’re responsible for validating that the API is fit for how your Application actually uses it, particularly for any decision with real-world financial or safety consequences.

17. Limitation of liability

To the fullest extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, or data, arising from these API Terms or use of the API. Each party’s total liability arising out of or relating to these API Terms is limited to the greater of (a) the fees you paid us for the API in the 12 months before the claim arose, or (b) $100. These limits don’t apply to a party’s indemnification obligations, gross negligence, willful misconduct, fraud, or anything else that can’t lawfully be limited in your jurisdiction.

18. Indemnification

You will defend and indemnify AskBiz against any third-party claim, and resulting damages and costs, arising from your Application, your use of data obtained through a Connection outside its granted Scopes, your violation of these API Terms, or your violation of applicable law.

19. Governing law and disputes

These API Terms are governed by, and disputes arising from them are resolved under, the same governing law and dispute-resolution provisions set out in the AskBiz Terms of Service, which are incorporated here by reference.

20. General

• Changes to these API Terms. We may update these API Terms from time to time; the “last updated” date at the top of this page reflects the current version, and a material change will be noted in the Changelog. Continued use of the API after a change takes effect means you accept the update.
• Entire agreement. These API Terms, together with the AskBiz Terms of Service, Acceptable Use Policy, Prohibited Activities Policy, Privacy Policy, Developer Privacy Addendum, and (where applicable) DPA, are the entire agreement between you and AskBiz regarding the API.
• Assignment. You may not assign these API Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of substantially all our assets.
• Severability. If any provision is found unenforceable, the rest remains in effect.
• No waiver. Failure to enforce a provision isn’t a waiver of it.
• Force majeure. Neither party is liable for a failure to perform caused by circumstances beyond its reasonable control.

21. Contact

Legal: legal@askbiz.co
Privacy: privacy@askbiz.co
Support: hello@askbiz.co
Company: AskBiz Ltd