Skip to content
Vendrix
Sign in

Vendrix API Acceptable Use Policy

This draft will be reviewed by counsel before it is published. Questions: [LEGAL CONTACT EMAIL — O-5].

This policy is part of the Developer Agreement. It defines what is not allowed on the Vendrix public developer platform (the "Platform"): the API, the console, the sandbox and webhooks.

1. Consent and messaging

  • Send only to people who opted in to receive the workspace's messages on WhatsApp, as Meta's WhatsApp Business Policy and Business Messaging Policy require.
  • Never send spam, unsolicited marketing, chain messages, or content Meta's policies prohibit.
  • Use approved message templates outside the 24-hour customer-initiated window, as the API enforces.
  • Honour every opt-out or stop request the business receives, and reflect it in the workspace state.

2. No abuse of the API

  • Do not exceed documented rate limits, the workspace daily send cap, or the per-key scopes.
  • Do not probe, scan or test the platform in ways meant to find weaknesses; report suspected vulnerabilities to the contact above within 72 hours.
  • Do not create multiple applications, keys or webhooks to bypass limits or controls.
  • Do not share or resell your access, keys or endpoint to a third party.

3. No misuse of data

  • Use the data the API exposes only for the workspace the key is scoped to and only for what the documentation permits.
  • Do not scrape, crawl or export the workspace's data beyond what your integration needs.
  • Do not request scopes beyond what your application needs (least privilege).

4. No prohibited content in templates or messages

  • No illegal products or services, no content prohibited by WhatsApp's policies, no highly sensitive categories (health diagnoses, political campaigning where prohibited, targeted at minors, financial products where banned) unless the platform and Meta explicitly allow it.
  • Keep templates accurate: no deceptive wording meant to trick a recipient into replying or paying.

5. Security duties

  • Keep keys and webhook secrets in a secrets manager; never commit them to source control.
  • Verify every webhook signature before acting on it; reject an expired timestamp (older than five minutes).
  • Immediately rotate secrets and revoke keys you believe were exposed; tell us at the contact above.

6. Enforcement

We may warn, rate-limit, suspend or terminate an application, key or endpoint for a violation, and where it is serious or repeated, suspend the workspace's developer access. We may act without notice where the law or a platform partner requires it.