API Terms of Service

These API Terms of Service govern use of the SparrowHawk CRM application programming interfaces (APIs), webhooks, importers, connectors, and other programmatic interfaces, whether currently offered or made available in the future. They supplement the Terms of Service.

API credentials are issued to a Customer organization. Credentials must be treated as confidential and rotated promptly if compromised. SparrowHawk CRM LLC is not responsible for actions taken by a party in possession of valid credentials.

The API may be used to:

• integrate SparrowHawk CRM with the Customer's own internal systems
• automate workflows within the Customer's organization
• extract or synchronize the Customer's data for reporting, backup, or migration
• build applications for the Customer's internal use or for the Customer's own end customers, subject to the Terms of Service and this policy

API access may not be used to:

• build, train, benchmark, or improve a competing product
• scrape aggregate platform data beyond the Customer's own organization
• circumvent plan entitlements, seat limits, feature gates, or usage caps
• resell API access without a written commercial agreement with SparrowHawk CRM LLC
• perform load or vulnerability testing without prior written authorization
• generate load that endangers platform stability or degrades service for other Customers

API endpoints are subject to rate limits published in developer documentation. SparrowHawk CRM LLC may throttle, queue, or reject requests that exceed those limits or that create disproportionate load. Fair-use practices — batching, caching where safe, respecting Retry-After headers, and handling errors gracefully — are required.

SparrowHawk CRM LLC uses versioned APIs where practical and will use reasonable efforts to give notice of breaking changes and deprecations. Customers are responsible for keeping integrations up to date within stated deprecation windows.

Data returned by the API is Customer Data of the Customer whose organization owns the credential and is subject to the Terms of Service and Privacy Policy. Customers must protect exported data with safeguards appropriate to its sensitivity and comply with applicable data-protection laws when re-using or disclosing it.

API consumers must:

• store credentials only on trusted systems and never in client-side code shipped to end users
• use TLS for every request and reject non-TLS responses
• rotate credentials on suspected compromise
• revoke unused credentials
• sign webhook verification correctly where required

Webhooks deliver events at-least-once. Consumers must be idempotent, verify signatures before acting on payloads, respond quickly to avoid retries, and provide a monitored endpoint. Failed webhook targets may be paused after repeated failures.

Unless a signed enterprise order form provides otherwise, API access is provided under the same support terms as the underlying platform and without a specific uptime SLA. Best-effort support is available at support@sparrowhawkcrm.com.

SparrowHawk CRM LLC may revoke credentials or restrict API access to protect the platform, comply with law, or respond to policy violations. Legitimate integrations that receive a warning will be given a reasonable opportunity to remediate before revocation, subject to the severity of the issue.