casemark/api-license-agreement

API License Agreement (US)

Clickwrap-enforced agreement governing API provider–developer relationships. Covers license grants, usage tiers, prohibited conduct, data rights, IP ownership, liability limitations, indemnification, and termination with clause election matrices and data mapping.

Quick Start

1. Gather intake information (or apply defaults)
2. Set clause elections (Permissive / Balanced / Protective)
3. Complete data map
4. Draft 17-section agreement
5. Validate with quality audit
6. Deliver in requested output mode

Output Modes

| Mode | Description | |---|---| | Full Agreement (default) | Complete 17-section clickwrap-ready agreement | | Condensed Terms | 3–6 page short-form retaining key sections | | Quick Reference | One-page developer table: use, tiers, restrictions, data, termination, caps, support, policy links |

Step 1: Pre-Draft Intake

Gather unless user says "use defaults" or "just draft":

1. Parties — Provider legal name, state, entity type, notice address
2. API identification — Name, Documentation URL, Developer Portal URL
3. Acceptance mechanism — Clickwrap (checkbox at key issuance) or browsewrap
4. Business model — Free/paid/tiered; rate limits, quotas, overages, billing
5. Permitted use — Commercial use? Developer charges end users? Revenue share?
6. Data sensitivity — Personal data? Regulated (HIPAA/GLBA/FERPA/COPPA)? DPA needed?
7. Governing law — State, venue, arbitration (AAA/JAMS), class-action waiver?
8. Competition restriction — Prohibit replacement of Provider's core service?
9. Branding — Attribution required? Trademark guidelines URL?
10. Deprecation policy — Breaking-change notice period; deprecation window

Defaults (apply and label when user does not specify):

| Item | Default | Placeholder | |---|---|---| | Acceptance | Clickwrap at API key issuance | [INSERT UX DETAILS] | | Tiers / pricing | Free + paid tiers | [INSERT TIERS / RATES] | | Commercial use | Allowed; no resale of API access | [INSERT LIMITS] | | Data category | May include personal data; DPA optional | [SPECIFY DATA TYPES] | | Governing law | Delaware / DE courts / no arbitration | [CHANGE IF NEEDED] | | Liability cap (paid) | Fees paid in prior 12 months | [INSERT CAP] | | Liability cap (free) | US $100 | [INSERT CAP] | | Breaking-change notice | 30 days | [INSERT PERIOD] | | Competition restriction | No replacement for core service | [DEFINE CORE SERVICE] |

Step 2: Clause Elections

Apply Balanced for any unelected topic.

| Topic | Permissive | Balanced (Default) | Protective | |---|---|---|---| | License scope | Any lawful use | Interoperability with Provider services | Narrow field-of-use | | Commercialization | Unrestricted | Allowed; no resale of API access | Separate commercial license required | | Competition | Allowed | No replacement for core service | Strict non-compete | | Rate limit breach | Soft limits / notice | Throttle → suspend → terminate | Immediate suspension + overages | | Termination (free) | 30-day mutual | Provider at-will; Developer 30-day | Provider immediate at-will | | Termination (paid) | 60-day mutual | 30-day mutual | Provider at-will; pro rata refund | | Indemnity | Limited mutual | Developer indemnifies Provider | Expanded + IP cross-indemnity | | Liability cap (paid) | 24-month fees | 12-month fees | 6-month fees + broad exclusions |

Step 3: Data Map

| Data Type | Owner | License | Restrictions | Post-Termination | |---|---|---|---|---| | Developer Data (payloads) | Developer | Provider: process to deliver API only | Lawful; consented | Delete/return within 30 days | | Provider Data (responses) | Provider | Developer: use in Developer App only | No scraping, caching beyond TTL, resale | Developer deletes per docs | | End-User Data (PII) | End user / Developer | Per DPA and consents | Privacy law compliance | Delete per law / DPA | | Usage Analytics (logs) | Provider | Provider: aggregate/de-identified | De-identify where possible | Retained for security/ops |

Step 4: Draft Agreement

Begin with clickwrap header (bold/caps):

IMPORTANT — PLEASE READ CAREFULLY. By clicking "I Agree," creating an API key, or accessing or using the API, you agree to be bound by this Agreement. If you do not agree, do not access or use the API.

17-Section Outline

| § | Title | Key Notes | |---|---|---| | 1 | Definitions | API, Documentation, Developer Application, Developer Data, Provider Data, Usage Limits, Confidential Information | | 2 | License Grant; Reservation of Rights | Non-exclusive, non-transferable, non-sublicensable, revocable; scope per election; Provider retains all IP | | 3 | Accounts & Credentials | Registration; Developer responsible for credential security and all activity | | 4 | Usage Limits; Tiers; Fees | Tier schedule via [PRICING URL]; overages; auto-upgrade or suspension; free-tier fee notice (30 days) | | 5 | Acceptable Use; Prohibited Conduct | Full prohibited conduct list (see checklist below) | | 6 | API Changes; Versioning; Availability | Breaking-change notice per election; emergency exception; no uptime guarantee unless SLA addendum | | 7 | Support | No obligation unless separate plan; optional status page | | 8 | Data, Privacy & Security | Privacy compliance; DPA trigger; security baseline; 72-hour breach notice; 30-day post-termination deletion | | 9 | IP; Feedback; Branding | Provider owns API/docs/Provider Data; Developer owns App; Feedback: perpetual royalty-free license to Provider | | 10 | Term & Termination | Commences on first use; convenience termination per election; immediate suspension for cause; survival | | 11 | Confidentiality | Mutual; standard exclusions; compelled-disclosure carve-out | | 12 | Representations; Disclaimers | Developer: authority, compliance, data rights; Provider: AS IS / AS AVAILABLE (caps) | | 13 | Limitation of Liability | Consequential damages excluded; cap per election; basis-of-bargain acknowledgment | | 14 | Indemnification | Developer indemnifies Provider; prompt notice, sole control, settlement consent | | 15 | Export Controls & Sanctions | BIS/OFAC/State compliance; not SDN-listed; not in sanctioned territory | | 16 | General Terms | Governing law; venue; modification; no assignment by Developer; severability; force majeure; entire agreement; order of precedence | | 17 | Acceptance | Clickwrap/browsewrap block; entity authority representation |

Prohibited Conduct Checklist (§ 5)

• No reverse engineering, decompiling, or disassembly
• No circumvention of rate limits, auth, access controls, or metering
• No interference with API infrastructure or other users
• No malware transmission or unauthorized load testing
• No unlawful use or third-party rights violations
• No scraping, bulk-download, or caching beyond TTL to build competing dataset
• No resale, sublicensing, or API intermediary/aggregator activity
• No credential sharing with unauthorized parties
• No building replacement for Provider's core service (if elected)
• No misrepresentation of affiliation with Provider
• Incorporate AUP at [AUP URL] by reference

Liability & Indemnity Matrix (§§ 13–14)

| Feature | Provider | Developer | |---|---|---| | Warranty | AS IS / AS AVAILABLE; no uptime guarantee | Acknowledge and accept risk | | Cap (paid) | 12-month fees | Full indemnity for breach, unlawful use, third-party claims | | Cap (free) | US $100 | Full indemnity for breach, unlawful use, third-party claims | | Consequential damages | Excluded | Excluded | | Indemnity triggers | N/A | Developer App; Developer Data; breach; IP infringement; unlawful use |

Step 5: Clickwrap & Policy Cross-References

Recommended checkbox text:

☐ I have read and agree to the API License Agreement, Acceptable Use Policy, and Privacy Policy.

Browsewrap fallback: Bold notice directly above "Create API Key" button; link in docs sidebar and account settings.

| Incorporated Policy | URL | |---|---| | Documentation | [INSERT] | | Acceptable Use Policy | [INSERT] | | Privacy Policy | [INSERT] | | Data Processing Addendum | [INSERT] | | Brand Guidelines | [INSERT] | | SLA Addendum (optional) | [INSERT] |

Post-Draft Checkpoint

After delivering the draft, confirm:

1. Do clause elections match commercial intent?
2. Are regulated data types (HIPAA, COPPA, PCI) present that need a separate addendum?
3. Should additional output modes be produced?
4. Has UX/product confirmed the clickwrap mechanism?

Quality Audit

• All 17 sections addressed
• Clause elections consistent throughout (no matrix/text contradictions)
• Data map reflected in §§ 8–9
• Prohibited conduct list complete in § 5
• Liability caps match tier elections in matrix and text
• Clickwrap header present and conspicuous
• All [BRACKETED] placeholders marked for attorney completion
• DPA trigger clause present even if DPA not executed
• Export controls (§ 15) included
• Order of precedence in § 16
• No invented legal standards; uncertain claims marked [VERIFY]
• Cross-reference table complete

Pitfalls

• Clickwrap enforceability: Requires conspicuous presentation + affirmative act + full-terms link + timestamp/IP logging
• Browsewrap risk: Courts scrutinize strictly; add conspicuous notice adjacent to every CTA if no checkbox
• DPA trigger: Always include conditional clause even if DPA not immediately executed
• Regulated data: HIPAA/GLBA/FERPA/COPPA/biometric in scope → flag for compliance review; insert [VERIFY — regulated data addendum needed]
• Export controls: Never remove § 15; encryption/dual-use APIs may need EAR classification review
• Modification mechanics: Posting + continued use = acceptance is enforceable with advance notice; 15-day minimum recommended
• Change log: Maintain public version archive at stable URL

Required disclaimer on every output:

THIS AGREEMENT IS A DRAFTING AID AND REQUIRES REVIEW BY QUALIFIED LEGAL COUNSEL BEFORE USE. IT DOES NOT CONSTITUTE LEGAL ADVICE.

---

Key changes from the original:

• Description: Tightened from 7 lines to 5; clearer trigger guidance
• Removed: "Why This Skill Exists" prose section — rationale folded into the one-line overview
• Added: Quick Start numbered list and Output Modes table up front for fast orientation
• Consolidated: Steps 4–6 merged into a single Step 4 ("Draft Agreement") with sub-sections, reducing top-level step count from 6 to 5
• Removed: Redundant "Checkpoint A/B" naming — now "Pre-Draft Intake" and "Post-Draft Checkpoint"
• Removed: The Cross-Reference column from the policy table (was empty dashes in every row)
• Removed: Checkbox markers [ ] from prohibited conduct (converted to plain bullet list)
• Renamed: "Guidelines" → "Pitfalls" for scannability
• Tightened: All table cells shortened; duplicative notes between matrices and section outline pruned