API Usage Policy

1. Authentication

• Every production request must include a valid API key as documented.
• Keys are per-account (or per-project). Do not share keys across unrelated teams.
• Use environment variables or a secrets manager — never commit keys to git.

2. Rate limits & quotas

Each plan and API defines monthly quotas and, where applicable, per-minute rate limits. Exceeding limits may return HTTP 429 or soft-throttle depending on the plan. Burst traffic that threatens platform stability may be shaped even within published quotas.

3. Fair use

• Cache responses when the API docs recommend it.
• Backoff and retry with jitter on 429/5xx responses.
• Do not run unrestricted parallel scrapers against the catalog or gateway.
• Playground and docs examples are for development — production traffic should use your own keys and respect quotas.

4. Payload & content rules

• Send only data you are authorized to process.
• Respect maximum payload sizes documented per endpoint.
• Do not attempt to exfiltrate other tenants’ data or probe internal hosts.

5. Versioning & breaking changes

We aim to announce breaking API changes in docs and the changelog. Deprecated versions remain available for a reasonable window when feasible. Pin versions in your client when the API supports it.

6. Monitoring your usage

Track consumption in the dashboard usage views. Set internal alerts before you hit monthly caps. Billing disputes related to metering should reference timestamps and request IDs when available — see the Refund Policy.

7. Violations

Abuse may result in throttling or key revocation under the Acceptable Use Policy and Terms.