API and Integration Terms
These terms apply when you use VoxaLink API keys, webhooks, bearer tokens, or similar integrations. They sit on top of the Customer Terms or Reseller Agreement, whichever you signed.
Contents
1. Credentials
API tokens and webhook secrets are confidential. You must store them securely, rotate them when we ask or when they may have leaked, and never put them in public client-side code or public repositories.
Tokens may be scoped by tenant, reseller, user, capability, product or environment. You must not use a token outside its authorised scope, and you must not share a token with a person who is not authorised for that scope.
2. Rate limits and changes
We may apply rate limits, quotas, concurrency caps, payload limits, endpoint restrictions or fair-use controls. We may change API behaviour for security, reliability, compliance or product evolution. Where a change is not backwards compatible and is likely to cause you more than minor detriment, we will give you at least 30 days' notice unless we need to move faster for security or law.
You must design integrations to tolerate retries, delayed delivery, duplicate events, partial outages, schema additions and token revocation. Use idempotency keys where we provide them.
3. Data access
You may only access data you are authorised to access. You must not scrape, enumerate, reverse engineer, bypass access controls, or attempt to infer data from tenants, customers or users outside your scope.
If your integration processes personal information, you must protect it, delete it when you no longer need it, and comply with the Privacy Policy and applicable privacy, spam and telecommunications laws.
4. No API SLA
Unless an order states a separate API service level, APIs are provided on an as-available basis. We do not promise a particular uptime, throughput or event-delivery time. Scheduled and emergency maintenance may affect APIs.
5. Suspension
We may revoke or suspend credentials if we reasonably believe they are compromised, being used outside scope, putting the services at risk, being used to originate scam or spam traffic, or associated with a breach of the Acceptable Use Policy or the Scam, spam and disruption policy.