Version 2026.08.06 · Effective 2026-08-06

Developer Terms

1. Scope

These Developer Terms govern use of the Pamphlet REST API, webhooks, MCP integrations, OpenAPI documentation, and related developer tools. They supplement the Terms of Service, Acceptable Use Policy, and Data Processing Addendum.

2. API access

API access requires a valid API Key scoped to a single Pam Pod. Keys are issued by Customer administrators, displayed once at creation, stored as SHA-256 hashes, and may include optional expiration.

Base path: /api/v1/pods/{podId}/. Authentication: Authorization: Bearer pam_<secret>. OpenAPI specifications are available at /api/v1/openapi and /openapi.json.

3. Rate limits and fair use

Default rate limit: one thousand (1,000) requests per hour per API Key unless a different limit is specified in an Order Form. Rate limit status is returned in X-RateLimit-Remaining and X-RateLimit-Reset headers.

Developers must implement backoff on 429 responses and must not attempt to circumvent limits through key rotation abuse or distributed scraping.

4. Security obligations

Developers must:

  • Store API Keys securely and never embed them in public client-side code
  • Rotate compromised keys immediately
  • Restrict keys to the minimum Pam Pod scope required
  • Validate webhook signatures using the X-Pamphlet-Signature HMAC before processing payloads
  • Acknowledge webhooks within ten (10) seconds and implement idempotent handlers

Pamphlet retries failed webhook deliveries with exponential backoff.

5. Personal Data and compliance

Developers processing Personal Data through the API must comply with the DPA, Privacy Policy, and applicable privacy law. Do not exfiltrate data across Pam Pods or use the API to build unauthorized data aggregation products.

6. MCP integrations

Model Context Protocol integrations must authenticate using Customer-issued credentials and respect Pam Pod isolation. MCP tools must not expose secrets, bypass approval gates, or perform destructive actions without explicit Customer configuration.

7. API changes

Pamphlet versioned REST APIs follow semantic versioning principles described in ADR 005. Breaking changes require a new API version. Pamphlet will provide reasonable notice before deprecating supported API versions except where immediate change is required for security.

8. Suspension

Pamphlet may suspend API access for abuse, excessive load, security risk, or violation of these Developer Terms. Customers may revoke keys at any time through workspace settings.

9. Contact

Developer support: cs@pamphlet.io · Documentation: /docs/api

Related policies