These API Terms of Use ("API Terms") govern access to and use of the IdeaScore application programming interface, its webhooks, the OpenAPI document, the developer documentation at /developers, and the IdeaScore apps for Zapier and Make (together, the "API"). They are published at /legal/api-terms and form part of the Terms of Service between CMS Group ("IdeaScore", "we") and the Customer. Capitalised terms not defined here have the meanings given in the Terms of Service.
1. Public Beta
1.1 The API is in Public Beta. It is a Beta Feature under section 8.2 of the Terms of Service. In particular:
(a) there is no service-level agreement: we do not commit to an uptime or a response time, and no service credits apply;
(b) the API is available to organisations on the Professional, Enterprise and Campus plans. A key of an organisation that is no longer on one of those plans is refused (403 plan_required);
(c) the version-1 contract under /api/v1 is stable and changes follow section 6 below, with the shorter notice period that applies during the beta; and
(d) every response carries the header X-IdeaScore-API: beta.
1.2 When the API reaches general availability, we will announce it in the developer changelog, with the longer notice period and any service commitments that will then apply.
2. Access and API Keys
2.1 Who may create keys. API keys are created by the organisation's owner in the Service. Each key has scopes that limit what it can read and change, a mode (live or test) and a daily IdeaScore AI credit cap.
2.2 Keys are confidential. API keys and webhook signing secrets are Confidential Information and credentials of the Customer. The Customer must:
(a) keep them secret, store them securely (for example in a secrets manager or environment variable), and never put them in client-side code, public repositories, URLs, logs or support messages;
(b) give each integration its own key with the narrowest scopes it needs;
(c) rotate or revoke a key at once if it may have been exposed, and tell us at security@ideascore.online; and
(d) remain responsible for all activity using its keys, whether or not authorised, until the key is revoked.
2.3 Our controls. We store only a hash of each key, and we may revoke or suspend a key that we reasonably believe is compromised or used in breach of these API Terms, with notice to the owner where reasonably possible.
3. Test Mode
3.1 Test keys (beginning isk_test_) work only with sample data, run IdeaScore AI on a test engine without charge, send no webhooks, and mark responses with X-IdeaScore-Mode: test. Use test mode to build and test integrations, so that real Applicants are never affected.
3.2 Test-mode data is not Customer Data about real people and may be reset at any time. Do not put real personal data into test requests.
4. Limits
4.1 Rate limits. Each key may make up to 60 requests a minute, with bursts of up to 120, and an organisation-wide ceiling applies across all of its keys. Every response carries rate-limit headers. A request over the limit receives 429 and should be retried after the time the headers give.
4.2 IdeaScore AI. IdeaScore AI runs through the API consume the organisation's Credits, as in the Service. Each key has a daily IdeaScore AI credit cap (by default 200 Credits; 0 means no IdeaScore AI). Past the cap, a run is refused (429 ai_daily_cap_reached) until the next day.
4.3 Idempotency. Write requests accept an Idempotency-Key header, remembered for 24 hours, so a retried request is not applied twice.
4.4 We may change these limits, and may set different limits for a particular Customer, to protect the Service. We will publish changes in the developer documentation.
5. Acceptable Use of the API
The Customer must not, and must not allow anyone to:
(a) use the API in breach of the Terms of Service, the Acceptable Use Policy, the Data Processing Agreement or applicable law;
(b) exceed or try to bypass rate limits, credit caps, scopes or plan restrictions, for example by using several keys or organisations to multiply limits;
(c) access data of another organisation, or data its key's scopes do not cover;
(d) use the API to build a product that competes with IdeaScore, or to copy substantial parts of the Service;
(e) resell, sublicense or provide API access to third parties, except to service providers acting for the Customer under confidentiality obligations (for example an integration partner or a Zapier or Make workflow the Customer controls);
(f) use data obtained through the API to send unsolicited messages, build profiles of Applicants unrelated to the Customer's programmes, or make decisions about people based solely on automated processing;
(g) use data obtained through the API, including AI Output, to train or improve any artificial-intelligence model, unless the Customer has its own lawful basis and its End Users have been told;
(h) introduce malicious code, run security tests, scan or load-test the API, except under our vulnerability disclosure terms on the Security page; or
(i) misrepresent its identity, or the source of a request, or imply that we endorse its application.
6. Changes, Versioning and Deprecation
6.1 Changes without notice. We may make additive, backwards-compatible changes at any time without notice: for example new routes, new optional parameters, new response fields, new values for status-like fields, new webhook event types, new error codes and headers, changes to the wording of messages, and fixes to behaviour that does not match the documentation. Integrations must tolerate these changes.
6.2 Breaking changes. A breaking change (one that could make correct code written to the documentation fail, such as removing or renaming a route, field or event, changing a field's type or meaning, making an optional parameter required, or changing authentication or scopes) is made only in a new API version, never inside /api/v1.
6.3 Deprecation notice. Before a route, field or version is retired, we deprecate it and give at least:
(a) 30 days' notice during the Public Beta; and
(b) 6 months' notice once the API is generally available.
A deprecated item keeps working, unchanged, until its sunset date. We may shorten the notice only where we must for a security or legal reason, and will say why.
6.4 How we notify. We announce each deprecation in the developer changelog, by email to the owners of the organisation's API keys, and in Deprecation, Sunset and Link response headers on every call to the deprecated item.
6.5 Discontinuing the API. We may discontinue the API, or the Public Beta, on the notice in section 6.3. If we discontinue the API during a Subscription Term for a Customer on a plan that includes the API and relies on it, the Customer may terminate its Subscription and receive a pro-rata refund of prepaid Fees for the unused part of the Subscription Term.
7. Webhooks and Integrations
7.1 Webhook deliveries are signed. The Customer must verify signatures before trusting a delivery, and must use an HTTPS endpoint it controls.
7.2 Data the Customer sends out of the Service through the API, webhooks, Zapier or Make is sent on the Customer's instruction. Once it reaches the Customer's systems or a third-party service, the Customer is responsible for it, and for having a lawful basis to send and use it.
7.3 Zapier and Make are third-party services. Their terms apply between the Customer and them; we are not responsible for their availability, security or use of data.
8. Customer Data, Ownership and Attribution
8.1 Customer Data accessed through the API remains Customer Data under the Terms of Service and the Data Processing Agreement.
8.2 We own the API, its documentation and the IdeaScore name and marks. The Customer may say that its integration "works with IdeaScore", but must not use our logo or imply partnership or endorsement without our written consent.
9. Warranties, Liability and Suspension
9.1 The API is provided "as is" and "as available" under section 15.3 of the Terms of Service. The limitations of liability in section 17 of the Terms of Service apply.
9.2 We may suspend API access, in whole or for a key, under section 11.2 of the Terms of Service, or if API use threatens the stability, security or performance of the Service for others.
10. Changes to These API Terms
We may update these API Terms under section 19 of the Terms of Service. Changes to limits or the documentation that do not reduce the Customer's rights may take effect when published.
11. Contact
Developer and API questions: support@ideascore.online. Security issues with keys or the API: security@ideascore.online.