API Terms of Use

1. API License

Subject to these API Terms, OrderBOT grants you a non-exclusive, non-transferable, revocable, and limited license to access and use our application programming interfaces (APIs) solely to connect your custom storefronts, CRMs, booking software, or POS databases to the OrderBOT conversational processing engine.

2. Acceptable Use & Developer Rules

Developers and merchants integrating with our API agree that they will not:

• Use the API to transmit spam, bulk messages, or violate WhatsApp's messaging rate limits.
• Sublicense, distribute, lease, or commercially exploit our API endpoints outside the scope of your specific business integrations.
• Attempt to circumvent, bypass, or test the vulnerabilities of the API security systems.
• Reverse engineer or attempt to extract the source code of the OrderBOT core NLP and conversational catalog routing engines.

3. Rate Limits & SLA

To ensure high availability and prevent Denial of Service (DoS) issues, OrderBOT enforces standard rate limits on our API requests. The default rate limit is set at **60 requests per minute** per merchant console token. If your integration exceeds this limit, the API will temporarily return an HTTP Status code **429 (Too Many Requests)**. We do not guarantee a specific service uptime SLA (Service Level Agreement) for free or starter accounts; however, premium enterprise accounts have access to custom SLAs.

4. Webhook Security

OrderBOT utilizes webhooks to send real-time cart updates, completed checkout notifications, and appointment slot reservations to your servers. You are solely responsible for:

• Ensuring your webhook destination URLs operate over secure HTTPS with TLS 1.2 or higher.
• Verifying the SHA-256 webhook signatures included in our headers to ensure messages originate from OrderBOT.
• Protecting your client secrets and console API access tokens. Never commit these keys into public client-side files or Git repositories.

5. API Deprecation Policy

As we iterate, some endpoints may be deprecated or upgraded. We will make reasonable efforts to provide at least **90 days' notice** via email or our developer console before making breaking modifications or removing deprecated endpoints. You agree to update your custom integrations within this deprecation window.

6. Termination of Access

We reserve the right to suspend or terminate your API access tokens immediately, without prior notice, if your integration causes excessive load, is identified as a vector for malicious attacks, or violates Meta's WhatsApp commerce guidelines.