Draft. Draft prepared from legal research, not yet reviewed by a licensed US attorney. Items in ⟦ ⟧ must be completed. Before this becomes final: confirm governing law and venue, complete the entity, address and contacts, and set up how a former customer asks for deletion (the Terms, DPA and Privacy Notice promise deletion within 30 days of such a request).

Version 2026-09-19-draft · effective September 19, 2026 SHA-256 730ef35f4435dfccfeaa1beee5e4acb2094c184734f6b840df82572d80d8b35e

Haularo API Terms

These terms apply when a customer creates an API key or configures webhooks or EDI. They add to the Terms of Service; the Terms’ disclaimers and limitation of liability apply to the API.

1. Access

An API key gives access only to the customer’s own Haularo data, and never to more than the person who created it can do. The customer is responsible for all activity using its keys, must keep them secret, and must revoke and replace a key that may have been exposed. We may revoke keys that are exposed or misused.

2. Limits

We apply rate limits per key. Requests over the limit receive HTTP 429 and should be retried later. Do not try to get around limits by using several keys.

3. Webhooks

Webhooks are delivered at least once, not necessarily in order; receivers should use the event id to ignore duplicates and must verify the signature and timestamp. Deliveries that keep failing are retried for about 21 hours and then marked failed. Webhook URLs must be public HTTPS addresses you control.

4. EDI

The customer is responsible for its trading-partner agreements, identifiers, mappings and for the accuracy of files it sends or receives. Haularo only reads and writes the files.

5. Changes

We will give at least 90 days’ notice before a change that breaks the documented API, except where a change is needed for security or by law.

6. Restrictions

Do not use the API to scrape or resell Haularo, build a competing product, or access data you are not entitled to.

All legal documents