Every document, published in full

Your right to use the API

1.1Subject to the Agreement, we grant you a non-exclusive, non-transferable, revocable right during your Subscription Term to call the API and to use our SDKs and widgets, for the purpose of building and operating integrations for your own internal business use, or for use by your own users where your plan permits it.

1.2The API returns data from your own organization only. A credential is scoped to the organization that issued it, and the scoping is enforced by the platform rather than by the client.

1.3Availability of the API is covered by the Service Level Agreement to the extent the API is part of the Covered Services there.

Credentials and their security

2.1API keys, tokens and signing secrets are credentials of the organization that created them, not of the individual who created them. You are responsible for every call made with a credential issued to your organization, whether or not you authorized it.

2.2You will keep credentials secret. Do not embed a key in a mobile application, a desktop application, a browser bundle, a public code repository, a support ticket, a screenshot, or anywhere else it can be read by someone who should not have it.

2.3Where a widget or an embedded view needs to run in a browser, use the short-lived embed token issued for that purpose rather than an API key.

2.4Rotate credentials when a person who had access leaves, and immediately if you suspect exposure. You can revoke and reissue at any time in your account.

2.5Tell us at security@workmonitor.ai without undue delay if you believe a credential has been exposed. We may revoke a credential ourselves, without notice, where we believe it is compromised or is being used in breach of the Agreement.

Rate limits and fair use

3.1Calls are rate limited. The limit that applies to a credential is resolved from any override set on that credential, then from your plan, and is shown in your account. When you exceed it, the API responds with HTTP 429 and a Retry-After header.

3.2Honour Retry-After. Back off exponentially on 429 and on 5xx responses, and add jitter so that a fleet of your workers does not retry in lockstep.

3.3Do not poll an endpoint more often than the data can change, do not run a synchronous retry loop against a failing endpoint, and do not parallelize to defeat a rate limit.

3.4We may apply, change or reduce limits to protect the platform. Where a change would materially affect an integration you operate, we will give you notice and, where we can, a period at the old limit while you adjust.

What you must not do with the API

4.1In addition to the restrictions in the Platform Terms of Service and the Acceptable Use Policy, you must not do any of the following.

• —Use the API to extract data in bulk for the purpose of building a competing product, or to train a machine-learning model.
• —Use the API to circumvent a feature limit, an entitlement, a Seat count or a plan restriction.
• —Re-sell, redistribute or provide access to the API or to data obtained through it, except to your own users within the scope your plan permits.
• —Cache or store data obtained through the API for longer than your own retention policy permits, or beyond the point at which the record was deleted in the Services.
• —Present data obtained through the API in a way that misrepresents its meaning, its freshness, or its source, or that suggests WorkMonitor endorses your product.
• —Use an undocumented endpoint, an internal endpoint, or a response field marked as internal or experimental. These change without notice and are not part of the API.
• —Reverse engineer, or attempt to discover the structure of, any endpoint that is not documented.

Versioning and deprecation

5.1The API is versioned in its path. We will not make a backwards-incompatible change to a released version.

5.2The following are not breaking changes, and your integration must tolerate them: adding a new endpoint, adding a new optional request parameter, adding a new field to a response, adding a new value to an enumerated field, and changing the order of items where no order was documented. Parse responses tolerantly and ignore fields you do not recognize.

5.3Where we deprecate a released API version, we will give at least 180 days' notice before it stops working, and we will mark deprecated responses so that an integration can detect the state before a person does.

5.4We may make a breaking change with less notice, or none, where it is necessary to close a security vulnerability, to stop unlawful processing, or to comply with a legal obligation. We will tell you what happened and why as soon as we can.

Embedded widgets

6.1Embeddable widgets render data from your organization inside your own product or site, authenticated by a short-lived token you mint server-side.

6.2You will not alter a widget's content, remove or obscure its attribution, or present its output as your own record of what happened. You will not use a widget to display data about a person to an audience that has no legitimate need to see it.

6.3You are responsible for the page a widget is embedded in, including its access controls. A widget honours the scope of the token you issue; it cannot know who is standing behind the screen.

Data protection when you build on the API

7.1Data you retrieve through the API is Customer Data, and you remain its controller. When you move it into your own systems, you are processing it there under your own responsibility, and our Data Processing Addendum does not extend to what happens after it leaves us.

7.2If your integration sends Customer Data to a third party, that party is your processor, not our sub-processor, and you are responsible for having terms in place with them.

7.3Where a record is deleted in the Services — by a retention sweep, by an erasure request, or by a user — you will delete the copy you hold, unless you have your own lawful basis to keep it and have told the data subject so.

Support and no warranty for your integration

8.1We support the API itself, as described in the Support Policy. We do not support, debug or maintain your code.

8.2We do not warrant that your integration will continue to work across changes to the Services that are not breaking changes to a released API version, and we are not liable for a failure of your integration or for a decision made on data your integration retrieved.

Suspension of API access

9.1We may suspend or revoke API access, in whole or in part and without notice, where a credential is compromised, where calls are degrading the Services for others, where we believe the API is being used in breach of the Agreement, or where we are required to act by law.

9.2Where we can, we will contact you first, and we will restore access promptly once the cause is resolved. Suspension of API access is not Downtime under the Service Level Agreement.

Changes to these terms

10.1We may update these API and Developer Terms as the API changes. Material changes are announced as described in the Platform Terms of Service and recorded in the Legal Change Log.