API Policy and guidelines

We give every business the same power we use ourselves: all Intersink products, including ours, use the same API. In return, the API is never a way to rebuild Intersink for others, to resell it, or to take data people did not expect to share.

1. Open your channel’s Settings › API and click Enable API (channels of businesses created on Intersink).
2. Create a test key and build: it reads your channel’s real data and never changes it.
3. Verify your business to create live keys, which can change data within their scopes.
4. Read the API reference for the apps installed on your channel.

• A key works on one channel only, with the scopes you choose from what the channel’s installed apps open.
• Give each key the fewest scopes it needs and one key per system, so you can revoke one without stopping the others.
• Browser calls are accepted only from your channel’s own web addresses (and localhost for test keys). Keep live keys on your server.

• Use data obtained through the API only for your channel’s own purposes, and only as long as needed.
• Do not sell it, share it with data brokers, use it for advertising profiles, or use it to build or train a competing service.
• Respect people’s choices: deletion, correction and opt-outs made on Intersink must be reflected in your systems within 30 days, or sooner where the law requires.
• Customer data of a channel belongs to that channel’s business. Never use it for another business.

• Rotate keys at least yearly and at once after any suspected leak.
• Use HTTPS everywhere; verify webhook signatures (Kodkila-Signature); protect your own users’ accounts with strong sign-in.
• Report suspected incidents to [email protected] within 24 hours.

• All keys of a channel share one rate limit: creating more keys never gives more requests. Retry with back-off on 429 and 503 responses.
• Each business’s first 1,000,000 live requests a month are included; above that, US$2.00 (or £1.60) per million on the monthly invoice. Test requests are free.
• Do not run load tests or scanning against Intersink without written permission.

An app that works with other businesses’ data (through the App Store, once it opens for such apps) goes through the developer program: the developer account and each project are reviewed, higher-risk scopes (personal data, writing data) need a verified business and a recorded check, and each approved project completes a yearly data use checkup. Until then, an API key never reaches another business’s data.

• Share keys or give anyone else access to the API.
• Offer a platform, white-label service or reseller product built on Intersink functions, or pass API access to the channels and businesses below yours.
• Scrape Intersink or get around scopes, domains, rate limits, test-key limits, reviews or suspensions.
• Build anything the Acceptable Use Policy forbids.

Breaking this policy can lead to a warning, a paused key, a suspended channel API or ending your API access, under the Developer Terms and the enforcement policy. Where there is a risk to people or to Intersink we act at once and tell you why.