API Terms of Service

This document governs use of the Nexus Trinity API ("the API"), a paid, subscription-based programmatic interface to the Contract Reader and Sanctions Screening. It supplements, and is incorporated into, the general Terms of Service, Acceptable Use Policy, and Limitation of Liability & Disclaimer. For the technical reference — endpoints, request/response format, error codes — see /api-docs.

1. Access

API access requires an active paid subscription, purchased via Stripe checkout. On successful payment, we issue you a single API key by email. The raw key is shown to you exactly once, in that email — we cannot recover or re-display it later. If you lose it, contact security@nexustrinity.io for revocation and reissuance.

2. Authentication

Requests must include your API key as a bearer token: Authorization: Bearer <your key>. Requests without a valid, active key are rejected. We store only a cryptographic hash of your key, never the raw value, after issuance.

3. Usage Quota

• Your account has two separate daily request limits — one for Contract Reader checks, one for Sanctions Screening checks — each corresponding to the tier you purchased and shown at checkout and in your welcome email. Usage of one does not count against the other.
• Each quota resets on a rolling 24-hour basis from each counted request, not a fixed calendar boundary.
• Exceeding your daily limit does not cause your request to fail. Unlike many APIs, we do not return an HTTP 429 or otherwise reject a request solely because you're over your plan's limit — the request still succeeds. When this happens, we're notified automatically (at most once per quota per rolling 24-hour window, so a burst of over-limit requests doesn't generate repeated alerts) so we can follow up about raising your limit. This is a deliberate design choice, not an oversight: a paying customer's workflow should not break because of a number on a pricing page. It is not a license to use the API without regard to your plan — see the Acceptable Use Policy, and note we may still revoke a key for sustained, unreasonable usage well beyond its tier.
• If our usage-tracking system itself is unreachable at the time of your request — a genuine infrastructure failure, distinct from being over your quota — the request is rejected rather than allowed through unchecked. The API fails closed on that specific failure mode only.

4. What the API Returns

POST /api/v1/check returns the same underlying analysis as the web Contract Reader (see the AI Governance & Disclosure Policy for how that analysis is generated and its limitations); POST /api/v1/screen returns a direct-match result against the OFAC sanctions list (see the Limitation of Liability & Disclaimer §2 for that feature's scope — it does not use AI). Both return structured JSON, plus your remaining quota for the current window. Neither returns a safety score or verdict, for the reasons described in those policies.

5. Availability

We do not currently offer a formal uptime SLA or service credits for downtime. We aim to keep the API available and will make reasonable efforts to communicate planned maintenance, but the API is provided subject to the "AS IS" / "AS AVAILABLE" terms in the Limitation of Liability & Disclaimer.

6. Subscription Management

• Your subscription bills on the cycle shown at checkout, via Stripe.
• Cancel anytime; your key remains active through the end of the current billing period and is automatically revoked when the subscription ends.
• We may revoke your key immediately, without refund, for violation of the Acceptable Use Policy — including sharing your key, reselling access, or attempting to bypass your quota.

7. No Resale Without Consent

You may not resell, sublicense, or provide bulk API access to third parties as your own product without our prior written consent. Using the API to power your own internal tool or product for your own use is fine; wrapping it and reselling it as a service is not, absent a separate agreement with us.

8. Changes to the API

We may change the API's request/response format, add or deprecate endpoints, or adjust rate-limit behavior over time. Where practical, we'll provide advance notice of breaking changes via the email on file for your account.

9. Contact

NexusTrinityio LLC
security@nexustrinity.io