API Usage Policy

Last updated: August 22, 2021

This API Usage Policy governs access to and use of APIs made available through services operated by Anthony Kung ("we", "us", or "our"). It is intended to establish technical and operational expectations for developers, integrators, and organizations that connect to our Services programmatically.

APIs are an important part of how customers and developers build on top of a platform. At the same time, API access can create security, privacy, fairness, and reliability risks if not managed carefully. This policy therefore describes permitted use, credential requirements, rate limiting expectations, security obligations, and the actions we may take to protect the Services and their users.

This policy supplements the Terms of Service. If an API-specific agreement, documentation page, or signed order form contains additional terms, those terms also apply to the relevant API offering.

1. Scope

This policy applies to all APIs, developer endpoints, webhooks, SDK-backed services, internal-to-external programmatic interfaces, preview APIs, and related developer surfaces we make available, whether public, private, partner-only, experimental, or generally available.

Programmatic access that is not expressly documented may still be subject to this policy where it interacts with our infrastructure or data.

2. Permitted Use

You may use our APIs only for lawful, authorized, and documented purposes. That generally includes building integrations, automating workflows, synchronizing data, and accessing platform functionality in a manner consistent with the intended purpose of the relevant API.

You must follow published documentation, implementation guidance, and technical limitations. If an API is offered only in beta, preview, or limited access form, you should assume that functionality and schemas may change rapidly and that production reliance may not be appropriate.

3. Credentials and Authentication

Certain APIs require API keys, bearer tokens, OAuth credentials, signed requests, or similar authentication mechanisms. You are responsible for protecting those credentials and controlling how they are issued, stored, and used within your environment.

At a minimum, you must:

keep credentials confidential
use separate credentials where reasonably appropriate for separate environments or applications
promptly rotate or revoke compromised credentials
avoid exposing secrets in public code, client-side applications, logs, or screenshots
use only credentials that were issued to you or your organization

You are responsible for all activity that occurs under your credentials unless applicable law provides otherwise.

4. Rate Limits, Throughput, and Fair Use

To preserve reliability, protect shared infrastructure, and reduce abuse, we may impose request limits, concurrency caps, burst controls, token budgets, or other usage thresholds. These controls may vary by endpoint, account, subscription tier, region, or operational conditions.

You may not:

circumvent or probe rate limits
distribute traffic across accounts or keys to evade enforcement
generate abusive, wasteful, or unnecessarily repetitive traffic
use the APIs in a manner that degrades platform performance for others
perform denial-of-service, resource exhaustion, or load-testing activity without express written permission

Traffic patterns that materially exceed normal, documented, or commercially reasonable use may be throttled, delayed, rejected, or blocked.

5. Data Use and Platform Integrity

Your use of API responses must be consistent with the purpose for which access was granted. Unless we expressly allow otherwise, you may not use the APIs or data obtained through them to build a competing service, create an unauthorized substitute dataset, resell protected data, or expose information to parties that are not authorized to receive it.

You may not use the APIs to scrape product surfaces or endpoints in a way that bypasses intended product access controls. You may not attempt to infer restricted information through systematic probing, traffic analysis, or misuse of undocumented behavior.

Where API responses contain personal data or customer data, you remain responsible for handling that data in compliance with applicable privacy, confidentiality, and security obligations. See our Privacy Policy for more information.

6. Security Obligations

You are responsible for securing your application, infrastructure, and integration points. API security is a shared responsibility: we secure the service-side environment, while you are responsible for your own systems, identity management, network exposure, and secret handling.

You should implement reasonable measures such as:

least-privilege access controls
secure secret management
input validation and output handling
audit logging where appropriate
patching and dependency maintenance
abuse monitoring and anomaly detection

If you discover a vulnerability affecting our APIs or related services, please report it under our Security Disclosure Policy.

7. Versioning, Changes, and Experimental Features

We may add, modify, deprecate, suspend, or discontinue APIs or API features at any time. For generally available APIs, we will try to provide reasonable notice before materially breaking changes where practical, but we cannot guarantee advance notice in every case.

Preview, beta, alpha, lab, and experimental APIs are provided with fewer stability expectations and may change or be removed without notice. You should not assume that such interfaces will become generally available or remain compatible over time.

8. AI-Enabled Endpoints

Some API endpoints may rely on model-powered or AI-assisted functionality. Use of those endpoints is also subject to our Acceptable AI Use Policy.

AI-enabled endpoints may produce variable or probabilistic output, may be subject to additional moderation systems, and may have different operational or safety constraints than deterministic APIs.

9. Monitoring, Suspension, and Revocation

We may monitor API usage for security, stability, fraud prevention, abuse detection, capacity planning, billing, and compliance purposes. If we reasonably believe that your use threatens the Services, violates this policy, or creates legal or security risk, we may suspend or revoke access with or without prior notice.

Examples of conduct that may result in restriction include:

repeated rate-limit evasion
unauthorized access attempts
automated abuse or spam
misuse of data obtained through the API
traffic patterns suggesting compromised credentials
use that threatens platform integrity or other users

10. Contact

Questions about API access, integrations, or this policy may be sent to support@anth.dev.