Core API AUP

Authorized Business: You may access an API only for a business, application, environment, and resource that you are authorized to administer or operate.

Documented Interfaces: You must use documented endpoints, methods, schemas, permissions, and integration flows. Undocumented or internal interfaces may not be accessed unless Nyxzie gives you express written authorization.

Customer and End-User Authority: You are responsible for obtaining all permissions, notices, and consents required to submit, retrieve, modify, or otherwise process data relating to your customers, employees, users, devices, transactions, or other third parties.

Resale and Delegation: You must not resell, sublicense, share, or provide third-party access to a Nyxzie Core API except through an approved partner, platform, agency, or reseller arrangement.

Server-Side Storage: Secret API tokens must be stored securely on trusted server-side systems. You must not expose live or sandbox secrets in browser code, mobile applications, public repositories, client-side logs, screenshots, support messages, or other locations accessible to unauthorized persons.

Least Privilege: You must request and retain only the token kinds, endpoint groups, permissions, origins, and environments required by your integration.

Credential Sharing: You must not sell, publish, transfer, or share API tokens or webhook secrets between unrelated businesses, applications, environments, or users.

Rotation and Revocation: You must promptly rotate or revoke a credential when it is no longer required or when you know or reasonably suspect that it has been exposed, copied, or misused.

No Access-Control Bypass: You must not alter token prefixes, requests, headers, origins, account references, or other identifiers to bypass token-kind restrictions, endpoint permissions, tenant isolation, subscription checks, expiry, revocation, or any other authorization control.

Schema Compliance: Requests must comply with the published method, content type, field constraints, and validation rules for the applicable endpoint. You must not intentionally submit malformed, deceptive, oversized, or harmful payloads.

Safe Retries: Automated clients must use reasonable timeouts, bounded retries, exponential backoff, and idempotency controls where supported. You are responsible for preventing duplicate charges, refunds, messages, pairings, or other side effects caused by your retry logic.

Polling: Polling must use documented intervals and stop conditions. Excessive polling, scraping, enumeration, or synchronization that creates unnecessary platform load is prohibited.

Concurrency: You must limit parallel requests and background jobs to levels appropriate for your subscription, documented limits, and the operational needs of your integration.

Client Identification: When required, you must provide accurate application, source, origin, callback, and correlation information and must not impersonate another customer, application, or Nyxzie service.

Limit Compliance: You must respect rate-limit and quota responses, including retry instructions, and reduce or pause traffic when a limit is reached.

No Evasion: You must not create or rotate multiple accounts, businesses, tokens, source addresses, origins, or environments to evade a rate limit, quota, suspension, billing requirement, or other service control.

Usage Measurement: API usage may be measured and reconciled asynchronously. Dashboard values may take time to reflect recent requests, but delayed display does not waive applicable limits or charges.

Plan Changes: Limits and available capabilities may change when a subscription is upgraded, downgraded, expires, is suspended, or is terminated. An API token does not independently grant access after its associated entitlement ends.

Environment Separation: Live credentials and live customer data must not be used in a sandbox or test environment unless the applicable documentation expressly permits it. Sandbox credentials must not be used to access or simulate unauthorized live activity.

Test Data: Use synthetic or properly authorized test data whenever possible. You must not submit real personal, payment, authentication, or confidential data to a test environment without a lawful and documented need.

No Production Reliance: Sandbox systems may be reset, changed, rate-limited, or unavailable without notice and must not be relied upon for production operations, permanent records, or service continuity.

Endpoint Control: You may register only webhook destinations that you own, control, or are expressly authorized to use. Webhook destinations must not be used to scan, probe, access, or attack local networks, cloud metadata services, internal systems, or third-party infrastructure.

Transport Security: Production webhook endpoints must use HTTPS when required by the applicable API documentation and must maintain valid certificates and reasonable network security.

Signature Verification: You must verify the documented webhook signature against the raw request payload before trusting or acting on an event. Signing secrets must be protected and rotated if compromised.

Replay Protection and Idempotency: Your webhook consumer must safely handle retries, delayed events, duplicate deliveries, and user-requested replay events. Use event identifiers, timestamps, and idempotent processing to prevent duplicate side effects.

Delivery Acknowledgement: Your endpoint must return the documented success response promptly. Long-running work should be queued after verification rather than blocking the webhook response.

Delivery Semantics: Unless a separate written service commitment states otherwise, webhook delivery is asynchronous and may be delayed, retried, duplicated, replayed, or delivered out of order. You must maintain reconciliation and recovery procedures appropriate for your application.

Replay Endpoints: Webhook replay or redelivery features may be used only for legitimate recovery, reconciliation, or testing. You must not use them to flood an endpoint, duplicate business actions, evade quotas, or interfere with another system.

Lawful Processing: You must collect, submit, receive, store, and use API data in accordance with applicable privacy, data-protection, consumer-protection, financial, communications, employment, and sector-specific laws.

Data Minimization: Submit and retain only data reasonably necessary for the documented purpose of the integration. Do not place credentials, secrets, payment-card data, or sensitive personal data in fields not designed for that information.

Security Controls: You must maintain reasonable administrative, technical, and physical safeguards for systems that access Nyxzie Core APIs or receive Nyxzie webhooks, including access controls, encryption where appropriate, dependency maintenance, monitoring, and incident response.

Tenant Isolation: You must not access, infer, correlate, export, or attempt to discover data belonging to another business, token, user, counter, transaction, or application.

Retention and Deletion: You are responsible for applying lawful retention and deletion periods to API responses, webhook events, logs, exports, and derived data stored in your systems.

Unauthorized Access: Accessing, modifying, enumerating, or testing accounts, tokens, data, resources, endpoints, or infrastructure without authorization.

Security Attacks: Introducing malware; exploiting vulnerabilities; bypassing a security control; performing denial-of-service activity; or conducting scanning, penetration testing, or coordinated security research without prior written authorization.

Fraud and Deception: Creating false identities, transactions, refunds, receipts, verification events, device records, account states, or other deceptive business records.

Authentication Abuse: Sending unsolicited or excessive authentication messages, attempting to obtain or verify codes without user authority, harvesting identifiers, taking over accounts, or using authentication services for spam, harassment, surveillance, or profiling.

Payment Abuse: Submitting unauthorized charges or refunds, laundering funds, testing stolen payment credentials, manipulating payment status, or using an API to evade gateway, merchant, or regulatory controls.

Webhook Abuse: Forging webhook events or signatures, replaying events to cause unauthorized actions, configuring malicious destinations, or using webhook delivery to attack or burden another system.

Service Replication: Scraping, bulk extracting, mirroring, benchmarking for competitive replication, reverse engineering, or using API output to recreate a Nyxzie service except where expressly permitted by an agreement or applicable law.

Unlawful Activity: Using an API to facilitate conduct, content, goods, services, communications, or transactions prohibited by applicable law or the Nyxzie General Terms of Service.

Your Application: You are responsible for the design, security, availability, accessibility, support, and legal compliance of your application and for all requests made using credentials issued to you.

User Experience: You must accurately describe your integration and must not imply that Nyxzie endorses, certifies, or operates your application unless Nyxzie has expressly authorized that representation.

Output Verification: You are responsible for validating API responses, webhook events, transaction states, and other outputs before relying on them for financial, operational, legal, safety-critical, or customer-facing decisions.

Records and Reconciliation: You must maintain records and reconciliation procedures appropriate to your use case, especially for payments, refunds, authentication, subscriptions, device management, and other state-changing operations.

Support: You are responsible for first-line support to users of your application. Nyxzie support does not replace your obligation to investigate your own code, infrastructure, configuration, and third-party dependencies.

Availability: APIs, webhooks, sandboxes, and developer tools are provided on an as-available basis unless a separate written service-level agreement applies.

Versioning: Nyxzie may introduce new API versions, fields, events, limits, or security requirements and may deprecate older versions or features. You are responsible for monitoring documentation and migration notices.

Compatibility: You must design clients to tolerate documented optional fields, additive response changes, retries, timeouts, and other normal distributed-system behavior.

Protective Changes: Nyxzie may immediately restrict an endpoint, token, event, destination, or feature when reasonably necessary to address abuse, compromise, legal requirements, platform integrity, or customer safety.

Incident Response: If a token, signing secret, webhook endpoint, application, or connected system is compromised, you must promptly contain the incident, revoke or rotate affected credentials, preserve relevant evidence, and prevent further unauthorized requests.

Notification: You must promptly notify Nyxzie at [email protected] when an incident may affect Nyxzie services, Nyxzie customers, shared infrastructure, or data processed through a Nyxzie Core API.

Vulnerability Reports: Suspected vulnerabilities must be reported privately and must not be exploited, publicly disclosed, or used to access data while Nyxzie investigates and remediates the issue.

Available Actions: Nyxzie may throttle traffic, reject requests, disable webhook delivery, revoke credentials, restrict an endpoint or environment, suspend a subscription, terminate API access, preserve relevant logs, or report unlawful activity to the appropriate authorities.

Immediate Protection: Nyxzie may act without prior notice when reasonably necessary to contain suspected credential compromise, fraud, abuse, security threats, unlawful activity, or material risk to customers or platform infrastructure.

No Refund for Violations: API access suspended or terminated because of a material violation of this policy is not eligible for a refund except where required by applicable law.