Reviewing an API terms of use agreement

An API terms of use agreement governs a dependency: a business builds a product on another company's API and lives with the provider's right to change, throttle, suspend or withdraw it. The terms are the provider's, accepted by generating a key, and they decide what the business may do with the API's data, who owns the integration, and how much notice the business gets when the API changes. I review the terms from the developer's side and return them marked up with a written explanation of what they commit the business to, the risks they leave open and the changes a provider will accept where it negotiates, for a fixed fee of £495 in three working days.

Who this is for

Software businesses, agencies and product teams in England and Wales building on a third party's API, whether a payments, mapping, messaging, AI, data or platform API, under the provider's published developer terms or a negotiated enterprise API agreement, and want to know what the dependency commits them to. The developer and the provider are businesses; data passing through the API may be personal data of the developer's users.

What to look for in an API terms of use agreement

The licence, the permitted use and the restrictions

The provider's software and documentation are protected as literary works under section 3 of the Copyright, Designs and Patents Act 1988, and the terms grant a limited licence to call the API for stated purposes, with restrictions on competing products, on caching or storing the API's data, on use by the developer's customers, and on combining the API with other providers' services. The review checks the permitted use against the developer's product, the restrictions on storing and displaying the data, the attribution and branding requirements, and whether the licence covers use by the developer's own customers through its product.

Rate limits, quotas, pricing tiers and what happens when you grow

The terms set rate limits and quotas by tier, with charges above them and the provider's right to throttle or cut off use that exceeds them. The review checks the limits against the developer's projected volumes, the overage pricing, the provider's right to change limits and pricing on notice, the notice the developer gets before a tier change, and whether the developer can commit to volumes in return for price certainty under an enterprise agreement.

Data passing through the API and the processor terms

The developer sends its users' data to the API and receives data back. Where that data is personal data, the provider processes it as the developer's processor under Article 28 of the UK GDPR and the Data Protection Act 2018, unless the terms make the provider a controller for its own purposes, which some do in order to use the data to improve the service or train models. The review checks the data processing terms, the provider's rights over the data it receives, the retention period, the location of processing and the transfer mechanism under Article 46, and the developer's obligations to its own users for what it sends to the provider.

Ownership of what you build and the provider's rights over it

The developer owns its own application, and the terms should say so; some providers claim a licence to the developer's application, its name and its marks, and some claim rights over improvements or feedback. The review checks that the provider's rights are limited to what it needs to operate and promote the API, that feedback clauses do not assign the developer's ideas, and that the provider cannot use the developer's application as an example without consent.

Deprecation, changes, suspension and withdrawal

The clause that decides the dependency is the one on changes: the provider's right to change the API, deprecate versions, suspend access for suspected breach or security risk, and withdraw the API altogether. The review asks for a stated notice period before a breaking change or a deprecation, for a migration period during which the old version remains available, for suspension to require notice and a chance to remedy except in an emergency, for a statement of reasons, and for withdrawal of the API to carry the longest notice the provider will give, so that the developer can replace the dependency.

Liability, service levels, security and the provider's insolvency

API terms disclaim availability, exclude liability for the developer's losses and cap the rest at the fees for a short period, with a service level only under an enterprise agreement. Where the terms are the provider's standard form, section 3 of the Unfair Contract Terms Act 1977 subjects the exclusions to the reasonableness test. The review asks for an availability commitment and credits, for the provider's security obligations to be stated, notes that unauthorised access to the provider's systems, including by exceeding permitted use, can be an offence under section 1 of the Computer Misuse Act 1990, and checks the position if the provider fails, since section 233B of the Insolvency Act 1986 restricts termination on the developer's insolvency, not the provider's. The Late Payment of Commercial Debts (Interest) Act 1998 applies to the fees.

What it costs

Standard review, £495. Marked-up document and a written explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the contract review page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• Your own contract returned with my amendments as tracked changes, plus a clean version with every change accepted, ready to send to the other side
• Comments in the document where a point needs explaining
• A written explanation of what I have changed and why, by email or as an attachment if it is lengthy, marking the points I would hold firm on and the ones that are negotiable
• A view on what is normal market practice and what is the other side pushing their luck
• One round of follow-up questions by email, included

What is not included

• Negotiating directly with the other side, which I quote separately once I know who is on the other side. Where the other side is willing to share a live document, I can work in that document directly
• Drafting a replacement contract from scratch
• Advice on the law of any jurisdiction other than England and Wales
• Tax, accounting or regulatory advice
• Disputes about a contract that is already signed

Questions I am often asked

The provider can change or withdraw the API at any time. Can we do anything about that?

Not on the published terms, which is why the review asks whether the provider offers an enterprise agreement, where notice periods, migration support and service levels can be negotiated. On the published terms the review sets out the notice you are promised and the dependency risk you are carrying.

Does the provider get to use our users' data?

Only to the extent the terms allow, and some providers reserve the right to use data passing through the API to improve their service or train models. The review checks the data terms, identifies whether the provider is your processor or a controller in its own right, and what you must tell your users.

Can the provider claim rights in the app we build on its API?

It should not, and the review checks. Provider terms sometimes take a licence to your application, its name and its marks for promotional purposes, and claim rights over feedback. The review limits those to what the provider needs to operate the API and keeps your application yours.

Related guidance and services

• Contract review, £495, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• Reviewing a data licence agreement
• Reviewing a SaaS vendor's terms before your business signs up

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.