API Terms

These terms are an agreement between you and [Company name] (placeholder, to be confirmed) ("Prismint", "we" and "us") about using the Prismint API, its webhooks and the developer docs (together, "the API").

Prismint doesn't offer API keys to the public. We issue keys only to:

• prismint.shop sellers, for managing their own selling; and
• partners Prismint invites in writing, for showing Prismint values in their own store.

By accepting these terms when you create or receive your first key, you agree to them on behalf of yourself and the business you sell for. If you're a seller, the Seller Agreement also applies, and it wins if the two disagree about selling on prismint.shop. The Prismint Terms of Use apply to everything else on Prismint.

While these terms are in effect, Prismint gives you a limited, revocable, non-exclusive licence to use the API. You can't transfer it or sublicense it. You may use the API only:

• as a seller, to run your own selling on prismint.shop: your inventory, stock, orders, shipments, claims, payouts and billing; and
• as a pricing partner, to show Prismint values to your own customers in your own store, as described in "Prismint values".

Everything we don't expressly give you here stays with Prismint. The API, the developer docs and Prismint values belong to Prismint.

Each key has one or more scopes, and a key can do only what its scopes allow:

• read: read your own inventory, listings, orders, shipments, claims and payouts.
• inventory: add, change and remove your inventory and stock.
• orders-billing: manage orders, shipments and claims, and read payouts and billing.
• pricing: read Prismint values. Prismint issues this scope only to an invited pricing partner. Sellers can't request it, and seller keys carry no value fields.
• master: every scope your account has been granted.

Your first key is issued by Prismint. After that, you can create more keys yourself, each with any of the scopes you've been granted, but never a scope you haven't been granted. Use the fewest scopes each key needs.

Live keys start with `ps_live_` and test keys start with `ps_test_`.

This section applies to keys with the pricing scope.

You may show Prismint values to your own customers, in your own store and on your own website or app, as part of selling or buying cards. You must not:

• sell, license, rent or give Prismint values to anyone else, alone or as part of a data feed, file or service;
• use Prismint values to build or run a pricing API, a price feed, a price guide or price comparison service, or any other product that does the job of Prismint values for others;
• export or collect Prismint values in bulk, beyond what your store needs to show values for cards you're selling or buying;
• use Prismint values to train or test a model that estimates card values; or
• try to work out how Prismint values are calculated, or which data goes into them.

Prismint values served through the API can be different from, or less complete than, the values shown in Prismint's own apps. Some cards or conditions may have no value through the API. We can change which values the API serves at any time.

The API gives you no rights to card images. Card images, where the API returns them, are for identifying the card only.

Prismint values are estimates built from market information. They are not offers, appraisals, grading opinions or guarantees, and they can be wrong, late or missing. You decide your own prices and you're responsible for them. Prismint isn't responsible for decisions you or your customers make based on Prismint values.

A listing price on prismint.shop is different. It's the price Prismint sells a card for, set by Prismint and locked when a buyer starts checkout. Listing prices follow the Seller Agreement and the Buyer Terms, not this section. In the API, listing prices are read-only.

You may store Prismint values only as long as you need them to show current values to your customers, and you must refresh them at least once every 24 hours. Don't keep an archive or history of Prismint values, and don't show a stored value as current after that interval.

If we ask, you must delete stored Prismint values within 10 days.

You don't have to name Prismint when you show Prismint values, but you may say they come from Prismint and link to prismint.app.

Don't say or suggest that Prismint endorses your store, and don't use Prismint's name or logo beyond saying where values come from. Don't name, guess or describe the data or sources behind Prismint values.

When using the API, don't:

• share your keys outside your own business, except with a service provider who works for you and is bound by these terms;
• use the API for anyone else's selling, or to offer an API, integration or service to other sellers;
• copy, scrape or collect data from the API or from Prismint's websites beyond what your own use needs;
• get around limits, scopes or security, including by using extra keys or accounts to get more requests;
• send harmful code, overload the API, or test its security without our written permission;
• use buyer information for anything other than what the webhook data terms allow; or
• use the API for anything unlawful.

Each key has request limits. We publish them in the developer docs and return them with every response in rate-limit headers. If you go over a limit, requests fail until the limit resets.

We may change limits. We'll give you notice before lowering a published limit, unless we need to act at once to protect the API. Repeatedly going over limits, or trying to get around them, can lead to suspension.

You're responsible for everything done with your keys.

• Keep keys on your servers. Don't put them in apps, web pages or code repositories.
• Store them in a secrets manager or environment variables, and share them only with people who need them.
• Rotate a key when someone with access to it leaves, or when you think it may have been exposed. When you rotate a key, the old one keeps working for a short overlap period so you can switch without downtime.
• Tell us at popsikle+prismint@gmail.com as soon as you know or suspect a key has been exposed.

Prismint stores only a scrambled (hashed) form of each key, so we can't show you a key again after it's created. We may revoke any key we believe is exposed or misused, and we'll tell you when we do.

Test keys (`ps_test_`) work only with test data. Test inventory never appears on prismint.shop, test orders are not real orders, and no money moves. Test webhook events are simulated.

We may reset test data at any time. Don't use live keys to test, and don't load-test the API without our written permission.

Some API responses and webhook events include buyer information, like a buyer's name and shipping address. You may use it only as the webhook data terms allow, and you must protect it as they require. The webhook data terms are part of these terms.

Webhooks you receive are signed. Check the signature on every webhook before acting on it, as the developer docs explain.

We improve the API over time. Changes that don't break existing integrations, like new fields, new endpoints or new event types, can happen at any time, so build your integration to ignore fields it doesn't know.

For a change that would break an existing integration, we follow the deprecation policy in the developer docs (`docs/api/deprecation-policy.md`). We announce it in the API changelog, mark affected endpoints with Deprecation and Sunset headers, and email the contact on your account before the change takes effect. We may need to act sooner to fix a security problem or to follow the law; if so, we'll tell you as soon as we can.

We may change these terms. We'll tell you at least 30 days before an important change takes effect, by email to the contact on your account and in the developer docs.

After an important change, you must accept the new version to create new keys. Your existing keys keep working for 30 days after the change takes effect, then stop working until you accept. If you don't agree, you can stop using the API and delete your keys.

We may suspend a key, or all your keys, at once if:

• a key is exposed or used in a way that puts buyers, sellers or Prismint at risk;
• you break these terms, the Seller Agreement or the law; or
• your use threatens the stability of the API.

We'll tell you why, unless the law or a security reason doesn't allow it, and restore access when the problem is fixed. You can ask us to look again at popsikle+prismint@gmail.com. Suspending your keys doesn't cancel orders already placed; they follow the Seller Agreement.

Keep confidential your keys and webhook signing secrets, any part of the developer docs or API that isn't public, the terms of any pricing key we issue you, and buyer information you receive. Use them only for what these terms allow.

This doesn't cover information that is public through no fault of yours, that you already had, or that you get lawfully from someone else without a duty of confidence. You may disclose confidential information when the law requires it, after telling us if the law allows.

The API and Prismint values are provided as-is and as available, without warranties of any kind. We do our best to keep them accurate and available, but we don't promise they will be.

To the fullest extent the law allows, Prismint isn't liable for lost profits or indirect or consequential losses arising from your use of the API. Our total liability to you under these terms is limited to the greater of $100 and the fees you paid us for the API in the 12 months before the claim.

If someone makes a claim against us because you broke these terms or the law, or because of how you used the API or buyer information, you agree to cover our reasonable costs from that claim.

You can stop using the API and delete your keys at any time. We can end these terms, or your access to the API, at any time with notice, or at once for a reason listed in "Suspension". If your seller account closes, your keys stop working.

When these terms end:

• your keys stop working;
• within 10 days, you must stop showing and delete any Prismint values you stored; and
• you must handle buyer information as the webhook data terms require.

"Confidentiality", "Values are estimates", "The API is provided as-is", this section and "Governing law and notices" still apply after these terms end.

These terms are governed by the laws of [State] (placeholder, to be confirmed), and disputes are handled in [County and state] (placeholder, to be confirmed), except where the law where you're based says otherwise.

We send notices to the contact email on your account. Keep it current. Send notices to us at [Mailing address for legal notices] (placeholder, to be confirmed) or popsikle+prismint@gmail.com.

Questions about the API or these terms: popsikle+prismint@gmail.com.