API and Integration Terms

Terms for the use of Quickbutik's APIs and integrations. This Supplementary Agreement forms part of Quickbutik's Terms of Service (version 2.0).

1. Definitions

In addition to the definitions in the Terms of Service, the following definitions apply in this Supplementary Agreement:

2. Applicability and Scope

These terms apply to all use of Quickbutik's APIs, webhooks, MCP servers, the CLI and third-party integrations connected to the Platform. The terms apply both to the Customer's own development and to development carried out by third parties on the Customer's behalf.

The API may be used to build and run External Storefronts (section 2.3 of the Terms of Service). Such use is subject to these terms, including the rate limits in section 4, and is not covered by the uptime guarantee in section 9 of the Terms of Service (see also section 9.1 of these terms).

The Customer is fully responsible for all API use that takes place with the Customer's credentials, regardless of whether the use is carried out by the Customer itself, a subcontractor or an automated system.

3. Access and Authentication

3.1 API credentials

API access requires valid API credentials generated via the Platform's administration interface. The Customer is responsible for:

• storing API credentials securely and never exposing them in client-side code, public repositories or insecure environments, except credentials that the API documentation designates as publishable
• immediately revoking and replacing API credentials upon suspicion of unauthorised access
• not sharing API credentials with other organisations or transferring them to third parties without Quickbutik's written approval, except developers, hosting providers and other service providers acting on the Customer's behalf, for whom the Customer is responsible

Publishable credentials are intended to be visible to End Customers in an External Storefront and only give the access that the API documentation states for them. Use of publishable credentials by End Customers or other third parties counts towards the Customer's rate limits, but is not a breach of these terms by the Customer if the Customer has used the credentials as the API documentation describes. Quickbutik may limit, block or require the rotation of publishable credentials to protect the Platform.

3.2 Authentication

All API calls must be authenticated with valid API credentials as described in the API documentation. Unauthenticated calls are rejected with HTTP 401.

4. Rate Limits and Quotas

4.1 Rate limits

Quickbutik applies rate limits and quotas to the API to protect the Platform and its Customers. The limits that apply are set out in the API documentation or communicated to the Customer, and Quickbutik may change them.

4.2 Rate limit handling

When a limit is exceeded, the API returns HTTP 429 (Too Many Requests), where applicable with a Retry-After header stating how long to wait before retrying.

The Customer is expected to implement exponential backoff on 429 responses. Systematic disregard of rate limits may result in temporary deactivation of API access.

4.3 Increased quotas

Customers requiring higher quotas may request this in writing. Increased quotas may be subject to an additional fee and are granted based on Quickbutik's assessment of the Customer's usage patterns and infrastructure capacity.

5. Permitted Use

In addition to the rules in the AUP (Supplementary Agreement C), the following applies specifically to API use. The Customer may not:

• use the API to replicate the Platform or to build a competing e-commerce platform
• redistribute or resell API access to third parties without Quickbutik's written consent
• cache or store data in a way that shows End Customers outdated prices or stock
• use the API to systematically extract data from other Customers' Shops
• send calls that deliberately probe the Platform's vulnerabilities (outside an agreed penetration test or good-faith reporting under section 3.2 of the AUP)
• manipulate data in a way that circumvents the Platform's business logic or validation rules

6. Webhooks

6.1 Configuration

The Customer configures webhook endpoints via the Platform's administration interface. The Customer is responsible for ensuring that the specified URL is available, uses HTTPS and can receive the requests described in the API documentation.

6.2 Delivery and retries

Quickbutik makes reasonable efforts to deliver webhooks, normally shortly after the event occurs. Quickbutik waits a limited time for a response and does not retry a delivery that fails or times out. The Customer should therefore not rely on webhooks alone, and should use the API to retrieve and reconcile data, for example orders.

6.3 Security

Each webhook can be configured with a secret key, which Quickbutik includes in every request to that webhook. The Customer shall enable the secret key, verify it for each incoming request before processing the data, and retrieve the data concerned through the API, as described in the API documentation.

7. Versioning and Changes

7.1 API versions

Quickbutik's API is versioned. The active version is specified in the URL (e.g. https://api.quickbutik.com/v2). Quickbutik may maintain several versions in parallel.

7.2 Changes

Quickbutik classifies API changes into two categories:

7.3 Deprecation

When an API version is deprecated, Quickbutik announces this at least 30 days in advance. During the deprecation period, the old version continues to function. After the end of the deprecation period, the old version may be disabled.

The Customer is responsible for migrating to the new version within the deprecation period.

The notice periods in this section do not apply where a change is required for security reasons or by law. In those cases, Quickbutik informs the Customer as soon as practicable.

8. Data and Personal Data

8.1 Data ownership

Data ownership is governed by section 6 of the Terms of Service. The API does not give the Customer access to other Customers' data. API credentials only give access to the Shops that the Customer, or the user the credentials were issued to, has access to.

8.2 Personal data via the API

When the Customer retrieves personal data (e.g. order data, customer records) via the API into its own systems, the Customer is the controller for that data in those systems. The Customer is in particular responsible for:

• not storing personal data for longer than necessary for the purpose
• ensuring that receiving systems meet the GDPR's requirements for technical and organisational security measures
• not transferring personal data to third countries without a legal basis

8.3 Data export and portability

The API supports export of the Customer's data in accordance with section 6 of the Terms of Service. Export via the API is available for as long as the Customer's account is active and during the 30-day transition period that applies after termination of the Agreement.

9. Availability and Performance

9.1 API availability

Quickbutik aims for the API to have the same availability as the Platform in general. The uptime guarantee and compensation in section 9 of the Terms of Service do not apply to the API. Scheduled maintenance windows are announced at least 48 hours in advance via the status page.

9.2 Status page

Current operational status, scheduled maintenance and incident history are published at quickbutikstatus.com. The Customer is recommended to subscribe to status notifications.

10. Third-Party Integrations

Quickbutik offers ready-made integrations with third-party services (e.g. shipping carriers, payment solutions, ERP systems). The following applies to these:

• The Customer enters into a separate agreement directly with the third-party provider. Quickbutik is not a party to that agreement.
• Quickbutik is not responsible for the availability, performance or data handling of third-party services.
• If a third-party integration ceases to function due to changes made by the third-party provider, Quickbutik makes reasonable efforts to restore the integration but does not guarantee a resolution time.
• The Customer is responsible for ensuring that its use of third-party integrations complies with the third party's terms and applicable legislation.
• Data shared with third-party services is subject to the third party's privacy policy. The Customer is responsible for informing its End Customers about such data sharing.

11. MCP, CLI and AI Integrations

Quickbutik provides MCP servers and a CLI that let developers and AI agents work with the Platform. The same terms apply to their use as to API use in general. This section applies to AI agents and tools that the Customer connects itself; Quickbutik's own AI Features, such as the Quick assistant, are governed by the AI Services Additional Terms. The following additions apply:

• Use via MCP or the CLI must be authenticated with credentials issued for the Customer's Account (such as a personal access token or the authorisation given when connecting) and is subject to the same rate limits and permissions.
• The Customer is responsible for all actions taken via MCP or the CLI, including actions taken by an AI agent, such as changes to product data, orders and Shop settings.
• Quickbutik is not liable for the consequences of incorrect or inappropriate actions taken by AI agents.
• The Customer should implement appropriate safeguards (e.g. confirmation steps, permission restrictions) to reduce the risk of unintended actions.

12. Intellectual Property Rights

The API's design, documentation, code samples and underlying technology are the property of Quickbutik or its licensors. The Customer is granted a non-exclusive, non-transferable right to use the API for the term of the Agreement.

The Customer retains all rights to the software that the Customer develops using the API (e.g. its own integrations, plugins). Quickbutik makes no claim to the Customer's code.

The Customer may refer to Quickbutik by name to describe that its integration works with the Platform. Any other use of Quickbutik's trademarks requires Quickbutik's prior written consent.

13. Limitation of Liability

The limitations of liability in section 13 of the Terms of Service also apply to API use. In addition:

• Quickbutik is not liable for damages arising from incorrect implementation of the Customer's integration.
• Quickbutik is not liable for loss of data resulting from the Customer's failure to correctly handle API responses (e.g. ignoring error responses).
• Quickbutik is not liable for outages or performance issues caused by third-party services.

14. Termination of API Access

API access ends when the 30-day export period after termination of the Agreement ends (section 5.5 of the Terms of Service), except as needed under Additional Terms that continue to apply. During that period, the API may only be used to export data, except as needed under Additional Terms that continue to apply (section 5.5 of the Terms of Service). In addition, Quickbutik may temporarily or permanently deactivate API access in the event of:

• breach of these terms (breaches of the AUP are handled under section 4 of the AUP)
• security threats (e.g. a leaked API key, an ongoing attack)
• systematic overloading of the infrastructure

In the cases in the second and third bullets, Quickbutik may deactivate API access immediately as a protective measure. Measures concerning the Account follow section 4 of the AUP. Where practicable, Quickbutik limits a measure to the credentials or function concerned rather than deactivating all API access to the Shop, since this may make the Customer's External Storefronts unavailable.

Quickbutik notifies the Customer as soon as practicable with a statement of reasons and, for temporary deactivation, the expected time of restoration. The Customer may appeal any deactivation under section 5 of the AUP.

15. Contact and Support

These terms are drafted in English, which is the legally binding version. Section 17.3 of the Terms of Service applies to translations.