API and Developer Terms.

Effective date: 2026-10-27.

These API and Developer Terms (these "Developer Terms") are between you and wrxstack ("wrxstack", "we", "us"). They govern your access to and use of the wrxstack application programming interfaces and related developer features described in section 2. wrxstack is an independent, privately owned product run by a small team, and can be reached at contact@wrxstack.com.

By creating an API key, registering an OAuth application, subscribing a webhook endpoint, connecting a client to the MCP server, or otherwise calling the API, you accept these Developer Terms. If you do not accept them, do not use the Developer Services.

The short version

1. How these terms fit with our other terms

These Developer Terms form part of, and are incorporated into, the Terms of Service (the "Terms"). Words defined in the Terms have the same meaning here unless these Developer Terms define them differently. The following documents also apply to your use of the Developer Services:

• the Acceptable Use Policy, which applies in full to everything you do through the Developer Services;
• the Privacy Policy, which explains how we handle personal data about you as a developer;
• the Data Processing Addendum, which governs our processing of personal data on behalf of a Customer; and
• the API documentation published at atlas.wrxstack.com/docs/api (the "Documentation").

Order of precedence. If these Developer Terms conflict with the Terms on a matter specific to the Developer Services, these Developer Terms control for that matter. The Data Processing Addendum controls on any matter of personal data processing that it covers. The Documentation describes how the Developer Services work. It does not override these Developer Terms or the Terms. If you have signed a separate written agreement with wrxstack that covers the Developer Services, that agreement controls to the extent of any conflict.

2. Definitions

3. Who may use the Developer Services

• You must be at least 16 years old and able to form a legally binding contract, as the Terms require.
• If you accept these Developer Terms for an organization, you confirm that you have authority to bind it.
• You may create Credentials for a Workspace only if your role in that Workspace allows it. A Workspace owner or administrator may revoke Credentials created in their Workspace at any time.
• You may not use the Developer Services if you are barred from doing so under the laws of any applicable country, including sanctions and export control laws, or if we have previously suspended or terminated your access to the Service for a breach.

4. Your right to use the Developer Services

Subject to these Developer Terms and the Terms, wrxstack grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to use the Developer Services during the time you have access to them, solely to build, test, and operate Applications that interact with the Service in the ways the Documentation describes.

Where we publish sample code or software libraries under a stated open-source license, that license governs the code itself. These Developer Terms still govern your use of the Developer Services that the code calls.

All rights not expressly granted in these Developer Terms are reserved. Nothing in these Developer Terms transfers ownership of any part of the Service to you.

5. API keys, tokens, and credential security

The Documentation describes two ways to authenticate: workspace-scoped API keys, which are intended for server-to-server use, and OAuth access tokens, which are intended for Applications that act on behalf of an End User. Whichever you use, you must:

1. keep Credentials secret, and store them in a secure secret store or environment configuration, not in source code, public repositories, client-side code, mobile application packages, logs, or support messages;
2. use OAuth, not a shared API key, where your Application acts for End Users other than yourself;
3. request and use only the access that your Application needs, and create separate Credentials for separate Applications and environments;
4. not share, sell, lend, or publish Credentials, and not use Credentials issued to someone else;
5. revoke and replace Credentials promptly if you believe they have been exposed, and tell us at contact@wrxstack.com with the subject "Security" if the exposure may have allowed access to User Data; and
6. remove Credentials you no longer use.

You are responsible for all activity carried out with your Credentials, including activity by your Application, by AI agents you connect, and by anyone who obtains your Credentials because you did not protect them. We may revoke or rotate any Credential that we reasonably believe is exposed, misused, or a risk to the Service or to End Users. Where reasonably practicable, we aim to tell you before or after we do so.

6. Permitted use and scope of access

You may use the Developer Services to read, create, update, and delete data in a Workspace, to receive events, and to automate work, in each case only:

• within the permissions that the Workspace grants to the Credential and to the person who authorized it. Role-based access controls set inside the Service continue to apply to every API request;
• for the purpose the End User or the Workspace owner authorized when they connected your Application;
• through the documented endpoints, methods, and parameters described in the Documentation; and
• in compliance with these Developer Terms, the Terms, the Acceptable Use Policy, and applicable law.

When your Application acts on behalf of an End User, it must make clear to that End User what it will do in their Workspace before it does it, and it must not take actions the End User has not authorized.

7. Rate limits and fair use

Use of the Developer Services is subject to rate limits and fair-use thresholds, as section 5 of the Acceptable Use Policy provides. The limits that apply to a Workspace are published in the Documentation and shown in the product, and the current state of a Credential's limit is returned in the response headers of each request. Limits may differ by plan and may change over time.

You must:

• stay within the limits that apply to you, and handle a "rate limited" response by slowing down and retrying later with a reasonable delay that increases with each retry;
• not create multiple accounts, Workspaces, or Credentials, or spread requests across them, in order to exceed or avoid a limit;
• use webhooks rather than frequent polling where webhooks meet your need; and
• not place a load on the Service that materially degrades it for other users.

Consistent with the Acceptable Use Policy, where use is excessive and materially degrades the Service for others, we may throttle it. Where reasonably practicable, we aim to give notice before we do so and may work with you to address the cause. Where the use is part of an attack or creates a risk to the security or availability of the Service, we may limit it at once, and we aim to tell you where reasonably practicable. Contact us if your Application needs higher limits. Any change to a limit is at our discretion.

8. Webhooks

• Endpoints you control. You may subscribe only endpoints that you own or are authorized to operate. Endpoints must use HTTPS.
• Verify every delivery. You must verify the signature on each delivery, as the Documentation describes, and reject deliveries that fail verification or that are older than the replay window the Documentation states.
• Handle duplicates. Deliveries can be retried and can arrive more than once or out of order. Your handler must be idempotent and must not rely on order.
• Protect the payload. Webhook payloads can contain User Data. You must treat them under section 11.
• Our rights. We may pause or remove a subscription to an endpoint that repeatedly fails, that appears to be misconfigured, or that sends delivered data somewhere the Workspace owner did not intend. We may tell the Workspace owner when we do so.

9. The MCP server and AI clients

The MCP server lets an AI client that supports the Model Context Protocol read and act on a Workspace through a permission-scoped interface. When you connect an AI client:

• You are responsible for what it does. Actions an AI client takes with your Credentials are treated as your actions. Review the permissions you grant, and use the approval and review controls the Service offers before allowing an agent to make changes.
• The AI client is a third-party service. Data the MCP server returns to an AI client is processed by that client and its provider under their own terms and privacy policies, not ours. wrxstack does not use Customer Content to train models, as section 8 of the Terms states, but we do not control what a third-party AI client or its provider does with data you send to it. Check their terms before you connect.
• Untrusted content. Content in a Workspace, or content an agent reads elsewhere, can contain instructions written to manipulate an AI agent. You are responsible for configuring your agent so that it does not act on such instructions without review.
• Consent of others. Do not connect an AI client to a Workspace that other people use unless the Workspace owner has allowed it.

10. Integrations and third-party services

The Service can connect to third-party products. As section 10 of the Terms provides, your use of a third-party product is governed by that third party's terms, and wrxstack is not responsible for third-party products. If you build or operate an integration, you must also comply with the terms of every third-party service it uses, including any limits those services place on how their data may be used, stored, or combined. We may suspend an integration that compromises security or breaches third-party terms.

11. Handling User Data

This section applies whenever your Application obtains User Data. It reflects the requirements of data protection laws such as the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and similar laws in other places. You must comply with all such laws that apply to you, whether or not this section mentions them.

11.1 Your role

11.2 Rules that always apply

1. Privacy notice. If your Application obtains personal data of anyone other than yourself, you must publish a privacy notice that is easy to find, accurate, and that explains what data you collect, why, how long you keep it, who you share it with, and how people can exercise their rights. You must follow it.
2. Lawful basis and consent. You must have a lawful basis for every use of personal data. Where the law requires consent, you must obtain it, record it, and let the person withdraw it as easily as they gave it.
3. Purpose limitation. You may use User Data only to provide the features of your Application that the End User asked for, and for no other purpose without their further, informed permission.
4. Data minimization. Request and keep only the User Data you need for that purpose.
5. No selling. You must not sell, rent, or trade User Data, share it for cross-context behavioral advertising, or give it to a data broker, advertising network, or similar service.
6. No other harmful uses. You must not use User Data to build profiles for advertising, to make decisions about a person's eligibility for credit, employment, housing, insurance, or similar matters, for surveillance, or to train a general-purpose AI model, unless the End User has given express consent and the law permits it.
7. Deletion when people ask. When an End User asks you to delete their data, revokes your Application's access, or deletes the account or Workspace your Application connected to, you must delete the User Data you obtained about them without undue delay and within the time the applicable law allows, unless the law requires you to keep it. You must not use any copy you keep for that reason for any other purpose.
8. Other rights. You must respond to requests from people to access, correct, export, or object to the use of their personal data within the time applicable law requires.
9. Retention. You must delete User Data once you no longer need it for the purpose for which you obtained it.
10. Transfers. If you transfer personal data to another country, you must do so lawfully, using a transfer mechanism that applicable law recognizes.
11. Sensitive data and children. You must not use the Developer Services to collect health data, payment card numbers, government identity documents, or other special categories of data. The Service is not designed for them, as our data handling page explains. You must not knowingly obtain personal data of anyone under 16 through the Developer Services.
12. Breaches. If you become aware of unauthorized access to, or loss of, User Data in your care, you must notify affected people and authorities where the law requires, and notify us at contact@wrxstack.com without undue delay.

wrxstack is not responsible for how your Application handles User Data once it leaves the Service. Where we receive a request from an End User about data held by your Application, we may pass it to you where we can identify you, and you must deal with it.

12. Security requirements

You must protect User Data and Credentials with administrative, technical, and physical measures that are appropriate to the risk, and at least the following:

• encrypt User Data in transit using current TLS, and protect stored User Data with encryption at rest or equivalent controls;
• limit access to User Data and Credentials to the people and systems that need it, and remove access promptly when it is no longer needed;
• keep your Application, its dependencies, and the systems it runs on up to date with security fixes;
• verify webhook signatures and validate all input your Application receives;
• keep records sufficient to investigate misuse of your Credentials; and
• not weaken or disable any security control of the Service.

If you find a security vulnerability in the Service, report it under our Responsible Disclosure Policy, which also sets the rules for good-faith testing. Testing the Developer Services outside that policy is not permitted. Our own security practices are described on our Security page and in our incident response statement.

13. Prohibited actions

In addition to the prohibitions in the Acceptable Use Policy, you must not, and must not allow or help anyone else to:

1. scrape, crawl, or systematically extract data from the Service by any means other than the documented Developer Services and within the applicable limits;
2. circumvent, disable, or interfere with rate limits, authentication, permissions, access controls, or any other technical limit of the Service;
3. use undocumented or private endpoints, or call the Developer Services in ways the Documentation does not describe;
4. decompile, disassemble, or reverse engineer any part of the Service, except to the extent applicable law expressly permits it despite this restriction;
5. access a Workspace or User Data without the authorization of its owner or End User, or attempt to access data that a Credential does not grant;
6. misrepresent your identity or your Application, or what your Application does with data, to End Users or to us;
7. resell, sublicense, or provide the Developer Services to third parties as a standalone service, or offer a product whose main purpose is to replicate the Service;
8. use the Developer Services to send spam, distribute malware, or carry out any activity that the Acceptable Use Policy prohibits;
9. use the Developer Services in any way that breaches these Developer Terms, the Terms, third-party rights, or applicable law.

14. Changes, versions, and deprecation

• Versions. The API version forms part of each request URL, as the Documentation explains.
• Changes that do not break. We may add endpoints, fields, event types, and parameters, and make other changes that do not break correctly built Applications, at any time without notice. Your Application must ignore fields and events it does not recognize.
• Breaking changes and deprecation. Before we make a change that removes or materially alters an existing feature of a stable API version, we aim to give at least 30 days' notice through the Documentation, the changelog, or email to the address on the account. Any support period stated in the Documentation is a goal, not a commitment.
• Exceptions. We may make a change with shorter notice, or none, where it is needed to address a security risk, to comply with law or a requirement of a third-party provider, or to prevent harm to the Service or its users. In those cases we aim to give such notice as is reasonably practicable.
• Discontinuation. We may discontinue any part of the Developer Services. Where we do so other than for one of the reasons above, we aim to give at least 30 days' notice.

You are responsible for keeping your Application compatible with the current Developer Services. No change, deprecation, or discontinuation gives rise to any payment or compensation.

15. Pre-release features

We may offer features labelled as preview, beta, experimental, or similar. They are provided for evaluation, may change or stop without notice, may be less reliable than other features, and are excluded from the deprecation notice in section 14. Do not rely on them for work you cannot afford to lose. Information about pre-release features that we share with you privately is confidential, and you may not disclose it without our permission.

16. Monitoring and cooperation

We record request metadata, such as the Credential used, the endpoint called, the time, and the response status, to operate the Service, enforce limits, keep the Service secure, and check compliance with these Developer Terms. Workspace owners can see activity in the in-app audit log. We do not inspect your Application's own systems. If we have a reasonable concern that your Application breaches these Developer Terms, we may ask you for information about how it uses the Developer Services and handles User Data, and you must answer accurately and promptly.

17. Suspension and enforcement

We may suspend or limit your access to the Developer Services, revoke Credentials, or disable an Application, in whole or in part, if:

• you breach these Developer Terms, the Terms, or the Acceptable Use Policy;
• your use creates a security risk, or harms or may harm the Service, its users, End Users, or third parties;
• we reasonably believe your Credentials have been exposed or misused; or
• we are required to do so by law or by a third-party provider on which the Service depends.

We enforce proportionately, following the approach in section 7 of the Acceptable Use Policy. Where it is lawful, reasonably practicable, and does not create further risk, we aim to tell you the reason and give you an opportunity to fix the problem. We may act without notice for severe violations or where the law requires it. Once the cause is resolved, we may restore access at our discretion, unless we have terminated it under section 24.

18. Branding and publicity

• You may state accurately that your Application works with or connects to wrxstack, Atlas, or Folio (our portfolio and personal-site builder).
• You must not suggest that wrxstack has built, endorsed, certified, or partnered with your Application unless we have agreed to it in writing.
• You must not use the wrxstack name, the names Atlas or Folio as they relate to wrxstack, or wrxstack logos in the name of your Application, its domain name, or its account names, or in any way likely to confuse.
• Any use of wrxstack names and logos must follow our Trademark and Brand Use Policy. We may ask you to change or stop any use, and you must do so promptly.

We will not name you or your Application in our marketing without your permission.

19. Ownership and feedback

As between you and wrxstack, wrxstack owns the Developer Services and the Service, and you own your Application, excluding any part of the Service it includes. End Users and Customers keep their rights in their Customer Content, as section 7 of the Terms provides. Feedback you give us about the Developer Services is covered by section 9 of the Terms, which grants us a license to use it without restriction or compensation.

20. No fees and no compensation

These Developer Terms do not create any fee payable by you. Access to the Developer Services may depend on the plan of the Workspace you use, and any pricing for a plan is set inside each product and governed by the Terms.

wrxstack does not pay developers. Nothing in these Developer Terms, and nothing you do under them, including building an Application, publishing an integration, reporting a problem, giving feedback, or being affected by a change, suspension, deprecation, or termination, creates any right to a payment, fee, revenue share, credit, reimbursement, reward, or compensation of any kind from wrxstack.

21. No warranties

THE DEVELOPER SERVICES ARE PART OF THE SERVICE AND ARE PROVIDED "AS IS" AND "AS AVAILABLE." SECTION 11 OF THE TERMS APPLIES TO THEM IN FULL. WITHOUT LIMITING THAT SECTION, WRXSTACK DOES NOT WARRANT THAT THE DEVELOPER SERVICES WILL BE AVAILABLE AT ANY PARTICULAR TIME, THAT WEBHOOKS WILL BE DELIVERED, DELIVERED ONCE, OR DELIVERED IN ORDER, THAT ANY API VERSION OR FEATURE WILL REMAIN AVAILABLE, OR THAT THE DOCUMENTATION IS FREE OF ERRORS. wrxstack offers no service level agreement for the Developer Services.

22. Limitation of liability

SECTION 12 OF THE TERMS APPLIES TO THE DEVELOPER SERVICES AND TO THESE DEVELOPER TERMS. CLAIMS ARISING UNDER THESE DEVELOPER TERMS AND CLAIMS ARISING UNDER THE TERMS ARE SUBJECT TO A SINGLE COMBINED LIMIT, AND THESE DEVELOPER TERMS DO NOT INCREASE THAT LIMIT. WRXSTACK IS NOT LIABLE FOR ANY LOSS ARISING FROM YOUR APPLICATION, FROM A THIRD-PARTY SERVICE OR AI CLIENT, FROM THE EXPOSURE OR MISUSE OF CREDENTIALS YOU FAILED TO PROTECT, OR FROM ANY CHANGE, SUSPENSION, DEPRECATION, OR DISCONTINUATION MADE IN LINE WITH THESE DEVELOPER TERMS.

Nothing in these Developer Terms limits or excludes any liability that cannot be limited or excluded under applicable law.

23. Responsibility for your application

You are solely responsible for your Application, for its compliance with law, for its handling of User Data, and for your relationship with your End Users. Section 13 of the Terms applies to any third-party claim arising out of or relating to your Application, your use of the Developer Services, or your breach of these Developer Terms, in the same way as it applies to your use of the Service.

24. Termination

• By you. You may stop using the Developer Services at any time by revoking your Credentials and removing your webhook subscriptions and client connections.
• By us. We may terminate your access to the Developer Services for a material or repeated breach of these Developer Terms, for any reason for which we may terminate under the Terms, or if we discontinue the Developer Services under section 14.
• Automatically. Your access ends when the account or Workspace your Credentials belong to is closed, or when your right to use the Service ends.

What you must do when access ends. You must stop calling the Developer Services, delete your Credentials, and delete all User Data you obtained through them, unless an End User has asked you, separately from wrxstack, to keep data you hold for them, or the law requires you to keep it. On request, you must confirm in writing that you have done so.

Survival. Sections 11, 13, and 19 to 23, the obligations in this section, and any other provision that by its nature should survive, continue after access ends.

25. Compliance with law

You must comply with all laws that apply to your Application and your use of the Developer Services, including data protection, consumer protection, electronic marketing, anti-bribery, export control, and sanctions laws. You must not use the Developer Services in, or make them available to any person in, a country or region, or to any person or entity, subject to sanctions or export restrictions that prohibit it.

26. Changes to these Developer Terms

We may update these Developer Terms. The effective date at the top shows the current version. For material changes, we give notice in the way section 15 of the Terms provides, through the Service, the Documentation, or by email. If you continue to use the Developer Services after a change takes effect, you accept it. If you do not accept a change, you must stop using the Developer Services.

27. General

Sections 16 (Disputes), 18 (Notices), and 19 (Miscellaneous) of the Terms apply to these Developer Terms. If any provision of these Developer Terms is held unenforceable, the rest remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Developer Terms without our prior written consent. Nothing in the Documentation, the changelog, sample code, or any wrxstack policy creates an obligation, warranty, or liability for wrxstack beyond those set out in these Developer Terms and the Terms, and the protections in sections 21 to 23 apply to all of them. These Developer Terms do not give any right to any person other than you and wrxstack.

28. Contact

For questions about these Developer Terms, to ask for higher limits, or to report misuse of the Developer Services, email contact@wrxstack.com. To report a security issue, use the subject "Security". Related documents: Terms of Service, Acceptable Use Policy, Privacy Policy, Data Processing Addendum, Sub-processor List, Data Deletion Policy, and the API documentation.