API Terms

Last updated: October 31, 2026

These terms supplement the Terms of Service and apply when you use the OS iXanagi API, connections through the Model Context Protocol (MCP), and webhooks (together, the "API"). If these terms conflict with the Terms of Service, the Terms of Service control.

• You create API keys in the console. A key carries permissions within those of the User who created it.
• Keep keys secret. Do not embed them in code that runs on your users' devices, such as a browser or mobile app.
• If you suspect a key has leaked, revoke it in the console at once and tell us at security@cloudeffects.com.
• Actions taken with a key are actions in your Tenant, and you are responsible for them.

The API has limits on calls and processing per period. Limits depend on your plan and are published in the API reference. Do not use multiple keys or accounts to get around them. Calls over a limit may be refused.

When you connect an outside AI client, such as claude.ai, through MCP, it acts within the permissions of the key or account used to connect. A connection through MCP can only read data; it cannot create, change or delete data, or send anything. Make changes in the console, where the AI Supplementary Terms apply to AI features. The outside AI client's own behavior is governed by its provider's terms.

• Webhooks we send are signed. Verify the signature before you act on one. We are not responsible for loss caused by processing an unverified webhook.
• If delivery fails, we retry a limited number of times. The same event may arrive more than once, so handle duplicates safely.
• Use a secure endpoint URL that you control.

We may change the API to improve it. We will give at least 90 days' notice before a change that breaks existing calls, or before removing a feature, unless a faster change is needed for security or legal reasons. Features offered as beta may change or end without notice.

In addition to the Acceptable Use Policy, you may not:

• resell or sublicense access to the API;
• use the API to build a service substantially similar to OS iXanagi;
• get around rate limits, permission checks or credit metering;
• try to access another tenant's data.

Data exchanged through the API is Customer Data, and the Data Processing Addendum applies to it. You operate the apps and integrations you build with the API, and you are responsible for the notices and consents their users need.

We may revoke keys or suspend API access for abuse, a security risk or a breach of these terms. Where reasonable, we notify you first.

API access is provided within your plan. AI features used through the API consume AI credits, the same as in the console.