API Terms of Use

1. What these terms cover

These API Terms of Use govern access to and use of every application programming interface that EBSCOed makes available for LER.me, now or in the future, including APIs for submitting records and files, retrieving information, and integrating other systems with LER.me, as described in the Documentation at help.ler.me.

They apply to every organization and person that obtains API Credentials or calls a LER.me API, and to anyone acting on their behalf, including developers and integration partners.

These terms are in addition to, not in place of, the agreements that already govern your use of LER.me.

If these terms conflict with a signed agreement between EBSCOed and your organization, the signed agreement controls for that organization. In every other case these terms control for API use.

By requesting API Credentials or calling a LER.me API, you accept these terms on your own behalf and on behalf of the organization you represent.

2. Definitions

Capitalized terms not defined here have the meaning given in the Software as a Service Agreement or the Terms of Use.

3. Access and API Credentials

API access is granted by EBSCOed to approved organizations. EBSCOed issues API Credentials through the process described in the Documentation and may require information about your organization, Your Application and its intended use before approving access.

API Credentials are issued to your organization, not to an individual, and remain the property of EBSCOed. You may use them only in Your Application and only for the purposes approved. You may not sell, share, lend or transfer API Credentials to any other organization, publish them, or embed them in code that is distributed to others.

You are responsible for everything done with your API Credentials, whether or not you authorized it. You will:

• store API Credentials securely and restrict access to the people and systems that need them;
• never place API Credentials in client-side code, public repositories, log files or support tickets;
• rotate API Credentials when a person with access leaves your organization or changes role;
• notify EBSCOed through help.ler.me as soon as you suspect that API Credentials have been exposed or misused.

EBSCOed may rotate, expire or revoke API Credentials at any time for security reasons, and will tell you through the Documentation or your registered contact where it is practical to do so in advance.

4. Acceptable use

You may use the API only to integrate Your Application with LER.me for the purposes described in the Documentation and approved by EBSCOed, and only in a way that complies with these terms, the Terms of Use, applicable law, and any agreement between EBSCOed and your organization.

You will not, and will not allow anyone else to:

• use the API to collect, harvest, scrape or extract data from LER.me beyond what the API returns for your authorized requests;
• use the API, or any data obtained through it, to develop, train, fine-tune, ground or improve any artificial intelligence or machine learning model or service, unless EBSCOed permits it in writing;
• access LER.me by any automated means other than the API and the interfaces EBSCOed provides;
• attempt to bypass or test rate limits, authentication, authorization, logging or any other security control;
• probe, scan or test the vulnerability of LER.me without EBSCOed's prior written agreement;
• use the API to send unsolicited messages, or to impersonate any person or organization;
• submit, upload or transmit malicious code, or content that is unlawful, infringing, defamatory or harmful;
• use the API in a way that interferes with the operation of LER.me or degrades the experience of other users;
• resell, sublicense or offer the API, or access to it, as a service to third parties;
• misrepresent the source of a request, or remove or alter any notice, identifier or attribution that EBSCOed includes in API responses.

EBSCOed may monitor API use to enforce these terms, protect the platform and its users, and improve the service.

5. Submitting data through the API

This section applies whenever you use an API to send data to LER.me, whether you are uploading files, submitting awards or credentials, creating or updating records, or sending any other Submitted Data. The Documentation for each API describes what it accepts.

Authority to submit. You may submit only data that your organization has the right to submit. For awards, credentials, completions or achievements, that means items your organization has itself conferred, verified or is otherwise authorized to record. For all Submitted Data, you confirm that you hold the rights and permissions needed, including any consent required from the individual it concerns.

Accuracy. You are responsible for the accuracy and completeness of the Submitted Data. EBSCOed records Submitted Data as received and does not independently verify it. Where the Documentation provides a way to correct or withdraw a submission, you will use it promptly if you learn that a submission was inaccurate or made in error.

Formats and limits. Submitted Data must follow the formats, schemas, size limits and field requirements published in the Documentation for the API you are using. EBSCOed may reject or hold any submission that does not meet them, that fails validation, or that appears to be duplicated, malformed or harmful.

Records delivered to Wallet Holders. Where Submitted Data results in a record being added to a Wallet Holder's Learning and Employment Record, such as an award or credential, that record becomes part of the Wallet Holder's record on delivery. From that point the Wallet Holder owns and controls it under the Terms of Use, including what they share, with whom, and for how long. Delivery is not reversed by the end of your API access or of any agreement between EBSCOed and your organization.

Age and sensitive information. You will not submit data concerning any person under fourteen (14) years of age. You will not submit medical or health information, or any other category of restricted information, unless the law permits it and a separate written agreement with EBSCOed covers it.

Content you submit. You will not submit content that contains malicious code, that infringes anyone's rights, or that includes personal information beyond what the API requires for its purpose. You keep ownership of the Submitted Data, and you grant EBSCOed the rights in section 6 to process it.

6. Data you submit and data you receive

Ownership. As between you and EBSCOed, you own the Submitted Data, and Wallet Holders own the contents of their Learning and Employment Records. EBSCOed owns LER.me, the API and the Documentation.

Licence to EBSCOed. You grant EBSCOed a non-exclusive, worldwide, royalty-free licence to receive, store, process, validate, display and deliver the Submitted Data for the purpose of operating LER.me, providing the Services to you and to Wallet Holders, providing support and reporting, and meeting legal obligations. EBSCOed may also use aggregated, de-identified information derived from API use for research, analytics and service improvement, in a form that cannot reasonably be linked to any individual or organization.

Personal data. Where Submitted Data includes personal information, EBSCOed processes it as described in the Privacy Policy and, for Customers, under the Data Processing Addendum to the Software as a Service Agreement. You are responsible for having a lawful basis, and any required notices and consents, for the personal information you submit.

Data you receive. Information returned by the API is provided for use in Your Application for the authorized purpose only. You will protect it with at least the care you apply to your own confidential information, will not disclose it to anyone who is not entitled to it, and will delete it when it is no longer needed for that purpose or when EBSCOed asks you to.

Data residency. Data submitted through the API is stored, processed and backed up within the United States.

Retention and deletion. EBSCOed retains Submitted Data for as long as needed to operate LER.me and meet its legal obligations, and retains records delivered to Wallet Holders under the Terms of Use. You may ask EBSCOed through help.ler.me to delete Submitted Data that has not been delivered to a Wallet Holder or otherwise incorporated into the Services.

7. Rate limits, availability and changes

Rate limits. EBSCOed applies limits on the number, size and frequency of API requests. Current limits are published in the Documentation and may change. Requests over the limit may be delayed or rejected. Your Application should handle rate-limit responses by backing off and retrying, not by opening additional connections or credentials.

Availability. The API is part of LER.me and is covered by the published Service Level Agreement, including its uptime commitment, scheduled maintenance and exclusions. Planned maintenance that affects the API is announced in the Documentation.

Changes. EBSCOed improves the API over time. Backward-compatible changes, such as new endpoints, new optional fields or new response values, may be made at any time, and Your Application should be built to tolerate them. Where a change is not backward compatible, EBSCOed will publish it in the Documentation and give notice before retiring the earlier version, with the notice period stated there. Security fixes may be applied without advance notice.

Versioning. Where the API is versioned, you are responsible for moving Your Application to a supported version before an earlier one is retired. Calls to a retired version may fail.

8. Your security obligations

You will:

• call the API only over encrypted connections using the transport security the API requires, currently TLS 1.2 or higher, and never disable certificate validation;
• keep Your Application, its dependencies and the systems it runs on patched and free of known vulnerabilities;
• limit the data Your Application requests and stores to what it needs for the authorized purpose;
• maintain reasonable administrative, technical and physical safeguards for API Credentials and for any data received from the API;
• report to EBSCOed through help.ler.me, as soon as you become aware of it, any security incident involving API Credentials, Your Application or data received from the API, and cooperate with EBSCOed's response;
• not attempt to access any account, record, file or endpoint that your API Credentials are not authorized for, even if it appears to be reachable.

If EBSCOed becomes aware of a confirmed security incident on LER.me that affects your organization, EBSCOed will notify your registered contact within the time stated in the Service Level Agreement.

9. Intellectual property and confidentiality

The API, the Documentation, and all software, schemas, formats, identifiers and other materials EBSCOed provides for API use are owned by EBSCOed and its licensors. EBSCOed grants you a limited, non-exclusive, non-transferable, revocable right to use them, during your period of authorized access, solely to build and operate Your Application in accordance with these terms. No other right is granted, by implication or otherwise.

You will not copy, modify, translate, reverse engineer, decompile or create derivative works of the API or any part of LER.me, except to the extent the law allows regardless of this restriction. You will not use EBSCOed's or LER.me's names, logos or trademarks without written permission, other than a factual statement that Your Application integrates with LER.me.

API Credentials, non-public parts of the Documentation, and any information EBSCOed identifies as confidential are EBSCOed's Confidential Information. You will protect them with at least the care you apply to your own confidential information, use them only as these terms allow, and return or destroy them when your access ends.

If you send EBSCOed suggestions or feedback about the API, EBSCOed may use them without restriction or obligation to you.

10. Suspension and termination

Suspension. EBSCOed may suspend or restrict your API access, with or without notice, if EBSCOed reasonably believes that you have not complied with these terms, that your API Credentials have been compromised, that Your Application is harming LER.me or its users, or that suspension is needed to protect the security or integrity of the platform or to comply with law. Where it is practical, EBSCOed will tell you the reason and what is needed to restore access.

Ending access. You may stop using the API at any time. EBSCOed may end your API access on notice if your organization's agreement with EBSCOed ends, if the API or a feature is discontinued, or for a breach of these terms that is not cured within a reasonable time after notice.

Effect. When your access ends, your rights under section 9 end, you will stop calling the API and will delete or return API Credentials and any data received from the API that you are not entitled to keep. Records already delivered to Wallet Holders remain in their Learning and Employment Records under the Terms of Use and are not affected. Sections 5, 6, 9, 11 and 12 continue to apply after access ends.

11. Warranties, liability and indemnity

As is. The API and Documentation are provided "as is" and "as available". EBSCOed makes no warranty that the API will be uninterrupted, error-free, secure, or compatible with Your Application, and disclaims all implied warranties, including merchantability, fitness for a particular purpose, title and non-infringement, to the fullest extent the law allows. The availability commitments in the Service Level Agreement are the only service commitments that apply to the API.

Your responsibility. You are responsible for Your Application, for the Submitted Data, for your use of data received from the API, and for everything done with your API Credentials. You will defend and indemnify EBSCOed and its affiliates against third-party claims, and the losses, costs and reasonable legal fees arising from them, to the extent they result from Your Application, from Submitted Data, from any award or credential your organization issues through LER.me, or from your breach of these terms.

Limitation of liability. To the fullest extent the law allows, EBSCOed is not liable for indirect, incidental, consequential, special or punitive damages, or for loss of data, profits, business or goodwill, arising from the API or these terms. EBSCOed's total liability arising from the API and these terms is limited to the fees your organization paid to EBSCOed for LER.me in the twelve months before the claim, or, where no fees were paid, to one hundred US dollars.

Where a signed agreement between EBSCOed and your organization contains different warranty, indemnity or liability terms, that agreement's terms apply to that organization in place of this section.

12. General

Changes to these terms. EBSCOed may update these terms from time to time. The current version is published at help.ler.me with its last-updated date. Continued use of the API after a change takes effect is acceptance of the change. Where a change materially reduces your rights, EBSCOed will give notice through the Documentation or your registered contact before it takes effect.

Governing law. These terms are governed by the laws of the Commonwealth of Massachusetts, without regard to its conflict of laws rules. Any dispute arising from these terms or the API will be brought only in the federal or state courts located in Essex County, Massachusetts, and you consent to their jurisdiction.

Export. The API and Documentation are subject to United States export laws. You will not use or export them in violation of those laws.

Entire terms. These terms, the documents they reference, and any signed agreement between EBSCOed and your organization are the complete terms for your API use. If any part of these terms is found unenforceable, the rest continues in effect. EBSCOed's failure to enforce a term is not a waiver of it. You may not assign these terms without EBSCOed's written consent.

Contact. Questions about these terms, requests for API access, security reports and support inquiries are submitted through help.ler.me.