API Terms of Use (India)

An API Terms of Use in India sets out the mutual obligations the parties accept and the terms that govern their dealings.

The Indian Contract Act 1872 provides the foundational legal framework for API terms of use as a contract: Section 10 requires a valid contract to have free consent, competent parties, lawful consideration, and a lawful object. Click-wrap API terms of use — where the developer clicks 'I Agree' or completes account registration — constitute acceptance under Indian contract law, as confirmed by several High Court decisions including the Bombay High Court's recognition of click-wrap agreements as binding contracts.

The IT Act 2000 is central to API governance. Section 43 imposes civil liability (compensatory damages) for unauthorised access to computer systems, computer networks, and computer resources — API terms must define the boundary between authorised and unauthorised access to prevent misuse claims. Section 43A imposes liability on 'body corporates' that handle 'sensitive personal data or information' (SPDI) negligently, creating a duty of care for API providers handling personal data. Section 66 criminalises hacking and unauthorised access, providing API providers with criminal law remedies against malicious API users.

The DPDP Act 2023, enacted by Parliament in August 2023, governs the processing of digital personal data of Indian residents. API providers processing personal data must comply with the Act's requirements for notice, consent, data minimisation, storage limitation, and data principal rights. The Data Protection Board of India — to be established under the DPDP Act — will adjudicate complaints and impose penalties up to ₹250 crore for significant breaches. API terms of use must address how personal data processed through the API is handled in compliance with the DPDP Act.

For fintech and payment APIs, the RBI's Guidelines on Regulation of Payment Aggregators and Payment Gateways (March 2020), the RBI's Master Direction on Prepaid Payment Instruments, the NPCI's UPI circulars, and the RBI's Account Aggregator framework impose additional API governance requirements that must be incorporated in API terms. SEBI's circulars on API access for capital market intermediaries impose obligations on technology vendors providing APIs to brokers and investment advisers.

The legal framework governing the API Terms of Use (India) in India draws on several key statutes and regulatory bodies. Under Indian law, the Indian Contract Act 1872 governs contractual obligations, with Section 10 setting essential requirements for valid agreements. The Companies Act 2013 regulates corporate entities through the Registrar of Companies (ROC) and Ministry of Corporate Affairs (MCA). The Industrial Disputes Act 1947 and state labour commissioners govern employment disputes. The Information Technology Act 2000 and IT (Reasonable Security Practices) Rules 2011 protect personal data. The Income Tax Act 1961 and Goods and Services Tax Act 2017 govern tax obligations through the Central Board of Direct Taxes (CBDT) and GST Council. Parties executing a API Terms of Use (India) in India should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Indian Contract Act, 1872 sets the foundational requirements.

India API Terms of Use are needed whenever an Indian technology company, SaaS provider, fintech, data aggregator, or platform operator exposes an API for use by third-party developers, business customers, or integration partners, and the API access involves commercially sensitive data, personal data of Indian residents, financial transactions, or regulated services.

SaaS and cloud platform API access: Technology companies providing SaaS products — enterprise software, HR platforms, ERP systems, e-commerce platforms, logistics software — that expose APIs for integration with customers' internal systems or third-party tools must publish API Terms of Use. The terms establish the permitted integration scope, rate limits, data handling obligations under the DPDP Act 2023, and liability allocation between the SaaS provider and the integrating customer.

Fintech and payment API providers: Companies operating payment aggregator APIs (regulated by the RBI), UPI SDK integrations (governed by NPCI's UPI circulars), account aggregator APIs (governed by the RBI's AA framework), and digital lending APIs (governed by the RBI's Digital Lending Guidelines 2022) must have API terms that incorporate the RBI's regulatory requirements for their specific product category. Without proper API terms, the fintech company may face regulatory action from the RBI for inadequate governance of its developer ecosystem.

Data and analytics API providers: Companies that aggregate and sell access to structured data — real estate price data, credit risk data, alternative data for lending, commodities price feeds, or traffic and logistics data — through APIs must define permitted use cases, data attribution requirements, and restrictions on redistribution. Where the data includes personal information of Indian residents, DPDP Act 2023 compliance provisions are mandatory.

Healthcare and telemedicine API integrations: Digital health platforms, telemedicine companies, and hospital management systems that expose APIs for integration with insurance providers, laboratories, pharmacies, and EMR systems must comply with the National Health Authority's Health Data Management Policy and, where patient data is involved, include strict DPDP Act-compliant data handling provisions in the API terms.

Government and e-governance API integrations: Companies integrating with government API platforms — DigiLocker API, Aadhaar e-KYC API (via UIDAI authorised agencies), GSTN API, CoWIN API, or state government open data APIs — must accept the government's API terms while also publishing their own downstream API terms for any sub-licensing of access to end users or business customers.

Thorough India API Terms of Use must address the full range of contractual, regulatory, and technical governance issues arising from API access in the Indian legal and regulatory environment.

Licence grant and scope: The API terms must grant a specific, non-exclusive, non-transferable, revocable licence to access and use the API for defined permitted purposes only. The scope must specify: whether the licence covers commercial use, internal use, or both; the geographic territory (India, worldwide); whether the developer may sublicense access to their own end users; the permitted application types (web application, mobile application, integration with specific platforms); and any prohibited use cases. Vague licence language creates uncertainty about permitted use and enforcement rights.

Authentication, security, and API key management: The terms must specify the authentication mechanism — API key, OAuth 2.0, JWT tokens, or two-factor authentication — and the developer's obligations to keep credentials secure, rotate keys periodically, and report any suspected credential compromise immediately. The developer must be prohibited from sharing API credentials with unauthorised parties. Under Section 43 of the IT Act 2000, using another party's API credentials without authorisation is punishable with imprisonment.

Rate limits, quotas, and SLA: Rate limits (API calls per minute, per hour, per day) and data transfer quotas must be clearly specified for each tier of service. The provider's right to throttle access upon limit breach and to modify rate limits on notice should be stated. Service level commitments (uptime percentages, response time targets) and remedies for SLA failure (service credits) should be addressed.

DPDP Act 2023 compliance — personal data handling: Where the API processes personal data of Indian residents, the terms must: identify whether the provider acts as a Data Fiduciary or Data Processor under the DPDP Act 2023; specify the categories of personal data processed through the API; require the developer (if acting as a Data Fiduciary) to obtain valid consent from Data Principals before processing their data through the API; impose security safeguard obligations on the developer under Section 8(4) of the DPDP Act; and specify breach notification obligations — the provider must notify the Data Protection Board and affected Data Principals of a personal data breach under Section 8(6) of the DPDP Act.

The API Terms of Use Act compliance — acceptable use: The terms must prohibit use of the API for activities that violate the IT Act 2000, including: unauthorised access to computer systems (Section 43/66); transmission of obscene material (Section 67); publication of sexually explicit content involving minors (Section 67B); identity theft (Section 66C); and violation of privacy (Section 66E). The terms should require developers to comply with all applicable laws including the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021.

Intellectual property ownership: The provider owns all intellectual property in the API, API documentation, SDKs, and related technology. The developer's application code remains the developer's IP, but must not contain any elements that replicate, reverse engineer, or decompile the API. The Copyright Act 1957 protects the API provider's code as a literary work; the Trade Marks Act 1999 protects the provider's brand used in any permitted marketing of API integration.

Liability cap and consequential damage exclusion: The provider's aggregate liability must be capped — typically at fees paid in the preceding 3 to 6 months, or a fixed monetary cap (₹5 lakh to ₹50 lakh) for free-tier access. Consequential, indirect, punitive, and special damages must be excluded. Indian courts apply the foreseeability principle from Hadley v. Baxendale, but express exclusion removes ambiguity.

RBI and sector-specific regulatory compliance for fintech APIs: Payment aggregator API terms must incorporate PCI-DSS obligations for card data handling, the RBI's merchant onboarding requirements, and settlement obligations. Account aggregator API terms must address the consent artefact requirement. UPI API terms must address NPCI's UPI Circular obligations on TPAPs. Fintech API terms should include a developer representation that they hold all required RBI/SEBI/IRDAI authorisations for their intended use of the API. The forms-legal.com API Terms of Use (India) template covers the mandatory elements under Indian Contract Act, 1872.