Omnito API Terms of Use

1. Purpose and Scope

These API Terms govern the access and use of Omnito’s Application Programming Interfaces (APIs), webhooks, and associated developer tools. These terms ensure that all server-to-server integrations maintain the security, multi-tenant isolation, and “Trustworthy AI” standards of the Omnito platform.

2. Authentication and Security Standards

  • Secure Protocols: All API communications must occur over HTTPS using TLS 1.2 or higher. Requests made over plain HTTP will be rejected.
  • Credential Confidentiality: API keys and OAuth tokens are confidential. You may not sell, share, or sublicense these credentials.
  • Server-Side Only: API keys must never be exposed in client-side code (JavaScript), public repositories, or mobile app binaries.
  • Rotation Policy: In alignment with our Trust Policies, users are encouraged to rotate API keys every 6 months. If a key is compromised, it must be revoked immediately via the Omnito Admin dashboard.

3. Usage Limits and “Fair Use”

To ensure platform stability for all customers, the following limits apply:

  • Rate Limiting: Omnito applies rate limits to API requests (e.g., requests per second). Exceeding these limits may result in temporary throttling or “429 Too Many Requests” errors.
  • No Scraping: You may not use automated tools (bots, crawlers, or scrapers) to extract large volumes of data or “poll” the API excessively. We recommend using Webhooks for real-time data updates.
  • Load Testing: Unauthorized load testing or penetration testing against Omnito API endpoints is strictly prohibited.

4. Data Privacy and “Least Privilege”

  • Data Minimization: The API is restricted to accessing the minimal data required for scheduling: Salesforce User IDs and Free/Busy availability.  
  • Prohibited Data Storage: You may not use the API to export or store private calendar event details (Subjects, Descriptions, or Attendee lists) unless expressly authorized for a specific integration.
  • DPA Compliance: All data processed via the API is subject to the Omnito Data Protection Addendum (DPA) and applicable laws (GDPR, CCPA).

5. Prohibited Developer Activities

You agree not to use the Omnito API to:

  • Compete: Develop a product or service that directly competes with the core Omnito/SUMO Scheduler platform.
  • Malware: Transmit viruses, worms, or harmful code.
  • Reverse Engineer: Attempt to decompile or derive the source code or underlying algorithms of Omnito’s AI scheduling models.
  • Misrepresentation: Present your application in a way that suggests it is officially endorsed or created by Omnito without written consent.

6. AI and Automated Scheduling

If using the API to interact with Omnito’s AI features:

  • Model Integrity: You must not use the API to provide “poisoned” data or manipulate the AI’s logic.
  • Accountability: The developer/customer is responsible for how AI-generated “Outputs” are used in their external workflows.

7. Monitoring and Termination

  • Activity Logs: Omnito monitors API activity to detect abuse, security threats, or performance drift.
  • Suspension: Omnito reserves the right to disable API keys or lock accounts immediately if these terms are violated.
  • Data Deletion Upon Termination: Upon termination of API access, you must delete all data obtained through the API, except where retention is legally required.

8. Support and Incident Reporting

If you discover a security vulnerability or an integration error, you must notify the Omnito Security Team immediately at [email protected].