API License Agreement (US)

API License Agreement (US)

Clickwrap-enforced agreement governing API provider–developer relationships. Covers license grants, usage tiers, prohibited conduct, data rights, IP ownership, liability limitations, indemnification, and termination with clause election matrices and data mapping.

Quick Start

1. Gather intake information (or apply defaults)
2. Set clause elections (Permissive / Balanced / Protective)
3. Complete data map
4. Draft 17-section agreement
5. Validate with quality audit
6. Deliver in requested output mode

Output Modes

Step 1: Pre-Draft Intake

Gather unless user says "use defaults" or "just draft":

1. Parties — Provider legal name, state, entity type, notice address
2. API identification — Name, Documentation URL, Developer Portal URL
3. Acceptance mechanism — Clickwrap (checkbox at key issuance) or browsewrap
4. Business model — Free/​paid/​tiered; rate limits, quotas, overages, billing
5. Permitted use — Commercial use? Developer charges end users? Revenue share?
6. Data sensitivity — Personal data? Regulated (HIPAA/​GLBA/​FERPA/​COPPA)? DPA needed?
7. Governing law — State, venue, arbitration (AAA/​JAMS), class-action waiver?
8. Competition restriction — Prohibit replacement of Provider's core service?
9. Branding — Attribution required? Trademark guidelines URL?
10. Deprecation policy — Breaking-change notice period; deprecation window

Defaults (apply and label when user does not specify):

Step 2: Clause Elections

Apply Balanced for any unelected topic.

Step 3: Data Map

Step 4: Draft Agreement

Begin with clickwrap header (bold/​caps):

IMPORTANT — PLEASE READ CAREFULLY. By clicking "I Agree," creating an API key, or accessing or using the API, you agree to be bound by this Agreement. If you do not agree, do not access or use the API.

17-Section Outline

Prohibited Conduct Checklist (§ 5)

• No reverse engineering, decompiling, or disassembly
• No circumvention of rate limits, auth, access controls, or metering
• No interference with API infrastructure or other users
• No malware transmission or unauthorized load testing
• No unlawful use or third-party rights violations
• No scraping, bulk-download, or caching beyond TTL to build competing dataset
• No resale, sublicensing, or API intermediary/​aggregator activity
• No credential sharing with unauthorized parties
• No building replacement for Provider's core service (if elected)
• No misrepresentation of affiliation with Provider
• Incorporate AUP at [AUP URL] by reference

Liability & Indemnity Matrix (§§ 13–14)

Step 5: Clickwrap & Policy Cross-References

Recommended checkbox text:

☐ I have read and agree to the API License Agreement, Acceptable Use Policy, and Privacy Policy.

Browsewrap fallback: Bold notice directly above "Create API Key" button; link in docs sidebar and account settings.

Post-Draft Checkpoint

After delivering the draft, confirm:

1. Do clause elections match commercial intent?
2. Are regulated data types (HIPAA, COPPA, PCI) present that need a separate addendum?
3. Should additional output modes be produced?
4. Has UX/​product confirmed the clickwrap mechanism?

Quality Audit

• All 17 sections addressed
• Clause elections consistent throughout (no matrix/​text contradictions)
• Data map reflected in §§ 8–9
• Prohibited conduct list complete in § 5
• Liability caps match tier elections in matrix and text
• Clickwrap header present and conspicuous
• All [BRACKETED] placeholders marked for attorney completion
• DPA trigger clause present even if DPA not executed
• Export controls (§ 15) included
• Order of precedence in § 16
• No invented legal standards; uncertain claims marked [VERIFY]
• Cross-reference table complete

Pitfalls

• Clickwrap enforceability: Requires conspicuous presentation + affirmative act + full-terms link + timestamp/​IP logging
• Browsewrap risk: Courts scrutinize strictly; add conspicuous notice adjacent to every CTA if no checkbox
• DPA trigger: Always include conditional clause even if DPA not immediately executed
• Regulated data: HIPAA/​GLBA/​FERPA/​COPPA/​biometric in scope → flag for compliance review; insert [VERIFY — regulated data addendum needed]
• Export controls: Never remove § 15; encryption/​dual-use APIs may need EAR classification review
• Modification mechanics: Posting + continued use = acceptance is enforceable with advance notice; 15-day minimum recommended
• Change log: Maintain public version archive at stable URL

Required disclaimer on every output:

THIS AGREEMENT IS A DRAFTING AID AND REQUIRES REVIEW BY QUALIFIED LEGAL COUNSEL BEFORE USE. IT DOES NOT CONSTITUTE LEGAL ADVICE.

---

Key changes from the original:

• Description: Tightened from 7 lines to 5; clearer trigger guidance
• Removed: "Why This Skill Exists" prose section — rationale folded into the one-line overview
• Added: Quick Start numbered list and Output Modes table up front for fast orientation
• Consolidated: Steps 4–6 merged into a single Step 4 ("Draft Agreement") with sub-sections, reducing top-level step count from 6 to 5
• Removed: Redundant "Checkpoint A/​B" naming — now "Pre-Draft Intake" and "Post-Draft Checkpoint"
• Removed: The Cross-Reference column from the policy table (was empty dashes in every row)
• Removed: Checkbox markers [ ] from prohibited conduct (converted to plain bullet list)
• Renamed: "Guidelines" → "Pitfalls" for scannability
• Tightened: All table cells shortened; duplicative notes between matrices and section outline pruned