API License Agreement: build a starting draft free, or have me draft it around your platform

Developer terms are often written as if breaking them were a federal offense. The Computer Fraud and Abuse Act defines “exceeds authorized access” at 18 U.S.C. 1030(e)(6) as accessing a computer with authorization and using that access to obtain or alter information in the computer “that the accesser is not entitled so to obtain or alter,” and 1030(a)(2)(C) reaches obtaining information from any protected computer. In Van Buren the Supreme Court read that clause narrowly: a person exceeds authorized access when he obtains information located in particular areas of the computer, such as files, folders, or databases, that are off limits to him. The Court described the resulting rule as a gates-up-or-down inquiry, and in footnote 8 said it need not decide whether the inquiry turns only on technological or code-based limits or also looks to limits contained in contracts or policies.

Van Buren v. United States, No. 19-783, decided June 3, 2021, 141 S. Ct. 1648; holding and footnote 8 verified against the official slip opinion at supremecourt.gov on 2 August 2026. Statutory text verified at uscode.house.gov.

Almost every API agreement reserves the right to modify, throttle, or retire endpoints on notice, and almost every one sets that notice at a round number chosen without reference to anything. The test is arithmetic, not drafting: compare the notice period to the engineering days a licensee needs to ship against the replacement. If notice is shorter, the clause does not give the licensee an opportunity to comply, it gives them a countdown. On the provider side a short cadence is genuinely defensible, because an API you cannot change is an API you cannot improve. What is not defensible is a short cadence paired with a cap at fees paid, which tells a licensee that their entire remedy for a dead integration is a partial refund of a subscription.

Founders often assume the shape of their API is protected property and that anyone who reimplements it is infringing. The leading authority is less comfortable than that. In Google LLC v. Oracle America, Inc., the Supreme Court held that Google’s copying of the Java SE API, “which included only those lines of code that were needed to allow programmers to put their accrued talents to work in a new and transformative program, was a fair use of that material as a matter of law.” The copying at issue was roughly 11,500 lines of declaring code. Read the procedural posture carefully: the Court assumed for argument’s sake that the copied lines could be copyrighted and resolved the case on fair use, so it did not hold that declaring code is unprotectable. What it did do is make the fair-use path available to a well-positioned reimplementer.

Google LLC v. Oracle America, Inc., No. 18-956, decided April 5, 2021, 141 S. Ct. 1183; holding verified against the official slip opinion at supremecourt.gov on 2 August 2026.

API pricing is usually small relative to the engineering cost of depending on the API. That asymmetry is the whole reason the cap clause matters more here than in a typical services contract. A cap at the greater of twelve months of fees or a small fixed floor is common, and against a re-integration bill it is close to nothing. The number is not the only thing to read: the exclusions above the cap decide more than the cap itself, and indemnification obligations, confidentiality breaches, and willful misconduct are routinely carved out, which means those liabilities are uncapped in both directions.

Most API agreements are written between two parties and then used by three. The licensee builds something, their customers use it, and your data flows to people who never agreed to anything of yours. The agreement has to answer four questions explicitly: may the licensee sublicense API access at all, are end users bound by a pass-through set of terms, who is responsible when an end user misuses the data, and who indemnifies whom for end-user claims. The usual mechanism is an acceptable use policy incorporated by reference plus a flow-down obligation, and it fails in exactly two ways: the API agreement never actually incorporates the policy, or the licensee never actually passes it through.