Recovea API & Developer Terms

Last updated: 2026-07-25

0. About these Terms

These API & Developer Terms (the "API Terms") govern your access to and use of the Recovea application programming interfaces, endpoints, SDKs, command-line tooling, ledger formats, verifier binaries, developer documentation, sample code, and related developer resources (collectively, the "API" or the "Developer Resources") made available by Recovea, Inc., a Delaware corporation ("Recovea," "we," "us," or "our").

These API Terms are product-specific and are incorporated by reference into, and form a part of, your overarching agreement with Recovea — that is, the Recovea Terms of Service / click-through terms or, where you have executed one, your Master Services Agreement and any applicable Order Form (collectively, the "Master Agreement," and together with these API Terms and the documents referenced below, the "Agreement"). Capitalized terms used but not defined here have the meanings given in the Master Agreement, the Recovea Data Processing Addendum (the "DPA"), the Recovea BYO-Key Addendum (the "BYO-Key Addendum"), the Acceptable Use Policy (the "AUP"), and the Recovea Privacy Notice. In the event of a conflict, the order of precedence stated in the Master Agreement controls; absent a more specific provision there, a signed Order Form (where it so states) controls over the Master Services Agreement, which controls over these API Terms, which control over general documentation, except that the DPA controls for the Processing of Customer Personal Data and the BYO-Key Addendum controls solely as to Provider Key handling, Provider Terms, Provider Charges, and runaway-spend allocation.

By generating a Recovea API key, sending a request to any Recovea endpoint, downloading or installing an SDK, CLI, or verifier, or otherwise accessing the API, you agree to these API Terms on behalf of yourself and the Customer entity you represent. If you do not agree, do not access or use the API.

Authority to bind; responsibility for Authorized Users. The individual accepting these API Terms or otherwise accessing the API represents and warrants that they are at least 18 years old and are authorized to bind the Customer to these API Terms. The Customer is responsible for all acts and omissions of its Authorized Users in connection with the API as if they were the Customer's own, including any use of, or activity under, any rcv_ key or Provider Key (whether or not authorized).

Eligibility. The API is offered to business customers only, for business and professional use, by persons who are at least 18 years old and authorized to bind the Customer. The API is not intended for personal, family, or household purposes, and nothing in these API Terms concerns investment or securities.

1. Definitions

For these API Terms, the following terms have the meanings below. Other capitalized terms are defined in the Master Agreement.

1.1. "Service" (and "Services") means Recovea's hosted instrument family and related managed services, offered as an umbrella that may include, without limitation: spend metering, telemetry, and observability; cost optimization; spend control (budget caps, alerts, and stop mechanisms); reporting and analytics; data ingestion and connectors; SDKs and APIs; related managed services; and any additional features or capabilities Recovea may make available. Any such capability is governed by the terms in effect when Recovea makes it available and is not active or licensed under these API Terms unless Recovea expressly states otherwise. Recovea may, in its sole discretion, add, modify, deprecate, or remove features and introduce alternative pricing or billing models (including subscription, usage-based, and savings- or outcome-based models) as further described in the Master Agreement and Section 9.

1.2. "API" / "Developer Resources" has the meaning in Section 0.

1.3. "Customer" means the legal entity on whose behalf the API is accessed and that is responsible for all use under its account.

1.4. "Authorized User" means an individual whom the Customer permits to access the API under the Customer's account and credentials.

1.5. "Recovea API Key" or "rcv_ key" means a credential issued by Recovea, bearing the rcv_ prefix, that authenticates inbound requests to the API on the Customer's account.

1.6. "Provider" means a third-party model or inference provider (for example, OpenAI, Anthropic, or OpenRouter) with which the Customer holds its own account and relationship.

1.7. "Provider Key" means an API key or credential issued by a Provider to, and owned by, the Customer.

1.8. "in-path" means that the Customer routes its own inference traffic through Recovea's gateway, which proxies that traffic to the Customer's chosen Provider on the Customer's own Provider Key.

1.9. "Inference Content" means the request and response payloads (including prompts, inputs, model outputs, and associated parameters) that pass through the API in-path.

1.10. "Usage Data" means metadata and telemetry about API requests (such as timestamps, model identifiers, token counts, latency, status, routing, and cost-relevant fields, which may include account, tenant, or user identifiers), as distinct from Inference Content bodies.

1.11. "the Ledger" means Recovea's hash-chained, append-only, offline re-derivable record of cost and usage events.

1.12. "Levers" means Recovea's cost-reduction mechanisms. At present, the live Levers are byte-identical exact-cache and deduplication/single-flight only.

1.13. "Fees" means the amounts payable for the Service and API access under the applicable Order Form, ToS, or pricing page.

1.14. "verified" means a particular savings, cost, or efficiency figure that Recovea has expressly designated as "verified" in a writing referencing that figure. Absent such written designation, all such figures are estimates. Any verification, attestation, or savings-based billing capability is governed by Section 9 and the terms in effect when Recovea makes it available, and is not active or licensed under these API Terms unless Recovea expressly states otherwise.

1.15. "Customer Personal Data" means personal data (as defined under applicable data-protection law) within Inference Content, Usage Data, or other materials that is provided by or on behalf of the Customer and that Recovea Processes on the Customer's behalf as a processor/service provider under the DPA.

2. API Access and Credentials

2.1. License grant. Subject to your continuous compliance with these API Terms, the Master Agreement, and the AUP, Recovea grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable license, during the term, to access and use the API solely to (a) route the Customer's own inference traffic in-path to the Customer's own Providers, and (b) use the Developer Resources to integrate with and operate the Service for the Customer's internal business purposes. All rights not expressly granted are reserved (see Section 11).

2.2. rcv_ key issuance. Recovea issues one or more Recovea API Keys (rcv_ keys) to the Customer through the Recovea console. Each rcv_ key authenticates inbound requests to the API and is associated with the Customer's account and tenant. rcv_ keys are secrets; they are presented once or are retrievable only by Authorized Users with appropriate access.

2.3. Credential security and responsibility. The Customer is solely responsible for (a) keeping all rcv_ keys and Provider Keys confidential; (b) all activity that occurs under its rcv_ keys, whether or not authorized; and (c) configuring access so that only Authorized Users can obtain or use credentials. The Customer must not embed rcv_ keys in client-side code, public repositories, mobile apps, browsers, or any location accessible to untrusted parties. The Customer must notify Recovea at security@recovea.ai without undue delay upon any known or suspected compromise of a credential.

2.4. Rotation and revocation. The Customer may rotate or revoke rcv_ keys at any time through the console; rotation issues a new key and allows the prior key to be retired. Recovea may rotate, scope, rate-limit, suspend, or revoke any rcv_ key where Recovea reasonably believes it is compromised, is being used in violation of these API Terms or the AUP, or poses a security, integrity, legal, or operational risk to Recovea, its other customers, or any third party. Where practicable and lawful, Recovea will provide notice; for security-driven actions, notice may follow the action.

2.5. Console sessions vs. API keys. Access through the Recovea console/browser uses an opaque, server-side session credential (an rcva_-style session reference). Raw upstream identity-provider tokens are never exposed to the browser. rcv_ keys are for programmatic API access; console session credentials are not a substitute for, and must not be used as, programmatic API credentials.

3. The BYO-Key In-Path Proxy Model

3.1. You bring and own your Provider relationships. The Customer brings and owns its own Provider accounts, relationships, and Provider Keys, and pays its Providers directly for all model and token usage. Recovea operates as a neutral conduit that proxies the Customer's in-path traffic to the Customer's chosen Provider on the Customer's own Provider Key.

3.2. Recovea does not resell tokens. Recovea does not resell, mark up, sponsor, fund, or take custody of Provider tokens or Provider spend, and is not a party to the Customer's agreements with any Provider. The Customer's Providers are the Customer's processors, recipients, or independent controllers — not Recovea sub-processors. All Provider charges, quotas, content policies, and terms are matters between the Customer and its Provider, and the Customer remains responsible for compliance with each Provider's terms and acceptable-use rules. Allocation of runaway or unexpected Provider spend is governed by the BYO-Key Addendum.

3.3. Credential stripping at the edge. Inbound credentials bearing Recovea's own prefixes (rcv_ and rcva_) are stripped before the request is forwarded upstream to the Provider; they are used only to authenticate the request to Recovea and are not transmitted to the Provider. The Customer's Provider Key is used to authenticate to the Provider as configured by the Customer.

3.4. No model substitution on the serve path. Recovea does not silently substitute models on the serve path. Where a Lever returns a cached response, that response is byte-identical to a prior Provider response and is never synthesized by Recovea.

4. Endpoints and Compatibility Scope

4.1. API host and endpoints. The API is served from api.recovea.ai, which exposes, among others:

• an OpenAI-compatible surface at /v1;
• an Anthropic-compatible surface at /anthropic; and
• routing for additional long-tail Providers (for example, via OpenRouter).

Additional tooling may include the recoveactl command-line interface, the recovea-chain-v1 open ledger format, and a standalone verifier binary.

4.2. Compatibility is for interoperability only. Recovea's OpenAI-compatible and Anthropic-compatible surfaces are provided to ease integration with existing client libraries. Compatibility does not imply any affiliation with, sponsorship by, endorsement by, or warranty from OpenAI, Anthropic, OpenRouter, or any other Provider. Recovea does not control, and makes no representation regarding, the features, parameters, behavior, deprecation, pricing, or availability of any Provider API. Provider-side names and trademarks are the property of their respective owners and are used only to identify interoperable interfaces.

4.3. Subset and divergence. Recovea may support only a subset of any Provider's parameters, routes, headers, or behaviors, and the supported subset may change. Recovea is not obligated to match any Provider's behavior, error format, or feature set, and may diverge where necessary for security, neutrality, metering, or operational reasons.

5. Fail-Open Passthrough Behavior (Honest Description)

5.1. Design objective, not a warranty. Recovea's gateway is designed to fail open: where Recovea is unable to apply a Lever or encounters an internal condition before a request reaches the Provider, the gateway is designed to pass the request through to the Customer's configured Provider rather than block it. Fail-open is a design objective and a reversible exit, not a warranty of availability, correctness, or uninterrupted service.

5.2. Pre-token fallback only; no mid-stream failover. Any fallback occurs before the first token is returned. Once a Provider response begins streaming, a downstream failure surfaces to the Customer as a clean error, not a silent splice or re-route. Recovea does not perform, and does not claim, mid-stream failover.

5.3. Spend control mechanisms. Where the Customer configures budget caps, alerts, or stop mechanisms, those mechanisms are designed to alert and to stop spend at configured thresholds. They are objectives of the design and are not warranted to alert or stop in every case, and they do not guarantee any particular spend outcome.

5.4. Reversible exit. The Customer can discontinue routing through Recovea at any time by re-pointing its base URL away from api.recovea.ai back to the Provider's native endpoint. This reversible exit — not any uptime commitment — is the Customer's primary reliability safeguard.

6. Rate Limits, Quotas, and Fair Use

6.1. Limits. Recovea may impose and adjust rate limits, concurrency limits, request-size limits, payload limits, and other quotas on the API, at the account, key, endpoint, tenant, or organization level. Current limits, where published, appear in the developer documentation; Recovea may change them with or without notice for operational, security, capacity, or abuse-prevention reasons.

6.2. Throttling and backpressure. Recovea may throttle, queue, delay, or reject requests that exceed applicable limits or that, in Recovea's reasonable judgment, threaten the stability, security, or fair allocation of the Service. Recovea may return standard rate-limit responses (for example, HTTP 429) and expects clients to implement reasonable backoff and retry logic.

6.3. No circumvention. The Customer must not use multiple accounts, keys, IP addresses, or other techniques to evade limits, quotas, or suspensions, and must not generate load designed to degrade or test the limits of the Service except as expressly authorized in writing.

6.4. Provider-side limits are independent. Provider-imposed rate limits, quotas, and throttling are governed by the Customer's agreements with its Providers and are outside Recovea's control.

7. Acceptable API Use

7.1. Compliance. All API use is subject to the AUP, which is incorporated by reference. Without limiting the AUP, the Customer and its Authorized Users must not, and must not permit any third party to:

(a) use the API in violation of any applicable law, regulation, sanctions or export-control restriction, or third-party right, or in violation of any Provider's terms or acceptable-use policy; (b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying ideas, methodology, or non-public structure of the Service, the Ledger, the Levers, the eval/verification logic, or any Recovea software, except to the limited extent this restriction is unenforceable under applicable law (see Section 8.1); (c) probe, scan, or test the vulnerability of the API or breach or circumvent any authentication, rate-limiting, isolation, or security measure, except under a separately authorized, written security-testing arrangement; (d) access the API to build a competing product, to benchmark for a competing product, or to copy or replicate the Service's features, the Ledger format, or the verification methodology, except to the extent of any interoperability rights that cannot lawfully be waived; (e) use the API to transmit malware, to conduct denial-of-service activity, to crawl or scrape beyond documented use, or to introduce automated load not arising from genuine inference use; (f) misrepresent the origin of traffic, impersonate any person or entity, or strip, falsify, or forge headers, identifiers, or credentials; (g) use the API for any high-risk use in which failure could lead to death, personal injury, or severe physical or environmental damage, without independent safeguards and Recovea's prior written consent; (h) resell, sublicense, time-share, or provide the API as a service bureau to third parties, except as expressly permitted in the Master Agreement; (i) remove, obscure, or alter any proprietary notice, or use any Recovea name, logo, trust mark, attestation mark, or certification mark except under a separate, written grant of rights; or (j) use the API, the Ledger, any Service output, or any Developer Resource to train, fine-tune, or develop any machine-learning model, or to create or populate a competing dataset, benchmark, or index.

7.2. Honesty in downstream representations. The Customer must not represent any Recovea-derived savings, cost, or efficiency figure as "verified," "settled," or "proven" unless Recovea has expressly designated that figure as verified in writing (Section 1.14). Absent such designation, all savings, cost, and efficiency figures are estimates. The Customer must not display any Recovea trust, attestation, or certification mark except under a separate, written grant of rights.

7.3. Regulated and special-category data. The Customer must not submit or transmit through the API any protected health information (PHI) governed by HIPAA, payment-card / cardholder data governed by PCI-DSS, biometric identifiers, government-issued identification numbers, data of children, or other special-category or specially regulated data, unless separately agreed in a signed writing (for example, a business associate agreement). Recovea offers no business associate agreement, is not a HIPAA Business Associate under these API Terms, and the Service is not HIPAA-validated or PCI-validated. The Customer is solely responsible for compliance with all laws applicable to its data and for ensuring such data is not transmitted through the Service absent a signed writing.

7.4. Customer responsibility for content and use. The Customer is solely responsible for its Inference Content, its prompts and outputs, its end users, and its determination that its use of the API and of any Provider is appropriate, lawful, and compliant with applicable AI, privacy, and sector-specific laws. Recovea is an infrastructure, observability, and cost conduit; it does not monitor, moderate, or assume responsibility for the content or lawfulness of Customer traffic, and routing is not individualized automated decision-making by Recovea.

8. Reverse Engineering, Versioning, and Deprecation

8.1. No reverse engineering. Except as expressly permitted in Section 2.1 or as cannot be restricted under applicable law, the Customer will not reverse engineer, decompile, disassemble, or attempt to discover the source code, models, weights, methodology, or trade secrets underlying the Service. Where applicable law grants a non-waivable right to obtain interoperability information, the Customer will first request that information from Recovea in writing, and Recovea may provide it on reasonable terms.

8.2. Versioning. Recovea may offer the API in versions and may introduce new versions, parameters, fields, headers, or behaviors. The Customer is responsible for testing its integrations against new versions and for handling additive, non-breaking changes (for example, new response fields) without error.

8.3. Deprecation. Recovea may deprecate, modify, suspend, or discontinue any version, endpoint, parameter, SDK, CLI, format, feature, or compatibility surface at any time. For changes that Recovea reasonably determines to be materially breaking to then-current, supported integrations, Recovea will use commercially reasonable efforts to provide advance notice (through the developer documentation, the console, the changelog, or email) and, where practical, a reasonable transition period. Recovea may make changes without advance notice where required for security, legal compliance, Provider-driven changes, fraud or abuse prevention, or to address a material operational risk. Recovea has no obligation to maintain backward compatibility indefinitely.

9. Fees, Billing, and Pricing Optionality

9.1. Fees. Access to the in-path API is part of the paid Service and is subject to the Fees stated in the applicable Order Form, ToS, or pricing page. The free, observe-only tier is in-path and metadata-only (it meters Customer's traffic but applies no Levers or spend-control enforcement and does not persist bodies by default). Current tier definitions and prices are stated on the Recovea pricing page and Order Form. No price, percentage, or dollar figure is stated in the body of these API Terms; pricing variables live in the Order Form and pricing page.

9.2. Pricing-model optionality. Recovea may offer subscription, usage-based, and savings- or outcome-based pricing and billing models for the Service and the API, and may introduce or change such models on a prospective basis, as described in the Master Agreement. No such model applies to the Customer except as expressly stated in the Customer's Order Form or other writing the Customer accepts. Any savings- or outcome-based model applies only on the Customer's separate, affirmative election and is governed by the terms in effect when Recovea makes it available.

9.3. Estimates and verified figures. Except where Recovea has expressly designated a figure as verified in writing (Section 1.14), all savings, cost, and efficiency figures presented through the Service are estimates and are not a guarantee of any financial outcome (see Section 13.3).

9.4. Auto-renewal and cancellation. Where a subscription auto-renews, the renewal term, renewal pricing, and cancellation rights are disclosed at or before purchase and governed by the Master Agreement. The Customer may cancel through self-serve online cancellation that is at least as easy as sign-up, and Recovea provides a pre-renewal reminder for annual terms where required. These practices are intended to comply with the federal Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. §8401 et seq., and applicable state automatic-renewal laws (including Cal. Bus. & Prof. Code §17600 et seq.).

9.5. Taxes. Fees are exclusive of applicable US sales and similar taxes, which are the Customer's responsibility except for taxes on Recovea's net income.

10. Data Handling for API Traffic

10.1. Roles. With respect to Customer Personal Data within Inference Content, the Customer is the controller and Recovea is a processor, as set out in the DPA, which governs and controls for the Processing of Customer Personal Data. With respect to Usage Data, to the extent it constitutes personal data, Recovea acts as a controller for metering, billing, Ledger integrity, fraud and abuse prevention, security, and its own operational and legal purposes, except to the extent Usage Data is Processed on the Customer's behalf as Customer Personal Data under the DPA. Recovea is also the controller of its own account, billing, prospect, marketing, and personnel data. Where Recovea Processes Customer Personal Data on the Customer's behalf, the DPA is automatically incorporated into and forms part of the Agreement; the DPA includes the CCPA/CPRA service-provider terms and the US-state addendum by default, with any international-transfer mechanism dormant for US-only operation.

10.2. Processing limitations; no model training. Recovea Processes Inference Content in-path solely to deliver, secure, meter, and operate the Service for the Customer, and Processes Usage Data (metadata) to meter usage, maintain the Ledger, and operate, secure, and improve the Service. Recovea does not use Inference Content or cached response bodies to train, fine-tune, or otherwise improve any model, and does not use Inference Content to "improve the Service" except as necessary to deliver, secure, meter, and operate it for the Customer. Request and response bodies are not persisted by default; the only content stored is the byte-identical exact-cache, keyed by a request hash, which stores cached response content solely to serve identical future requests and is subject to the same processing limitations and retention rules as Inference Content. This handling is stated identically in the Privacy Notice, the DPA, and the Retention documentation.

10.3. Providers as Customer recipients. As stated in Section 3, the Customer's Providers receive Inference Content as the Customer's recipients/processors/independent controllers, not as Recovea sub-processors. Recovea's sub-processors are limited to its infrastructure and platform vendors (for example, its cloud-hosting and payments vendors, and email/identity vendors), as listed in the subprocessors disclosure.

10.4. Retention and erasure. Retention periods and the customer-erasure process are governed by the Retention documentation and DPA. Consistent across the legal pack, on a verified customer-erasure request Recovea (a) purges the request-keyed cache of the Customer's cached response bodies and (b) retains a content-free integrity record of the Ledger (a tombstone plus severance of the customer identifier to null, executed via recoveactl erase-customer) as permitted by law, so that erasure does not destroy the append-only integrity of the cost record. Recovea may, in its sole discretion, offer additional erasure tooling.

10.5. Aggregated/De-identified Data. Recovea may create and use Aggregated/De-identified Data derived from Usage Data, meeting applicable de-identification/anonymization thresholds and subject to a no-re-identification commitment, as described in the Privacy Notice and DPA.

10.6. Hosting region. The Service is hosted in the United States (AWS, US region).

11. Intellectual Property and Feedback

11.1. Recovea IP. As between the parties, Recovea and its licensors own all right, title, and interest in and to the Service, the API, the Developer Resources, the Ledger and recovea-chain-v1 format, the verifier, the SDKs, CLIs, documentation, and all software, methodology, models, and trade secrets, and all intellectual property rights therein. These API Terms grant only the limited license in Section 2.1; all other rights are reserved under a broad reservation of rights.

11.2. Trademarks. "RECOVEA" and Recovea's other names, logos, and marks (including any trust, attestation, or certification marks) are claimed as common-law marks (™ / ℠) pending any registration; nothing here grants the Customer any right to use them except as expressly permitted in writing. The Customer must not represent that any of its offerings is verified, attested, or certified by Recovea absent a separate written grant.

11.3. Customer Data and Inference Content. As between the parties, the Customer owns its Inference Content and Customer Data. The Customer grants Recovea the limited rights to host, process, transmit, cache, and meter such content solely to provide, secure, meter, and operate the Service and as further described in the DPA. Recovea takes no position on the ownership of model outputs.

11.4. Feedback. If the Customer or any Authorized User provides suggestions, ideas, or feedback about the API, the Customer grants Recovea a perpetual, irrevocable, worldwide, royalty-free, fully paid license to use and exploit that feedback without restriction or obligation.

11.5. Open-source components. SDKs or tooling Recovea distributes as open source are licensed under their stated open-source license, which governs those components to the extent of any conflict with these API Terms.

12. Confidentiality

12.1. Obligations. Each party may receive the other's Confidential Information. The receiving party will protect it with at least reasonable care, use it only to exercise rights and perform obligations under the Agreement, and not disclose it except to personnel and advisors bound by confidentiality obligations no less protective. These obligations survive for five (5) years after disclosure, except that obligations as to trade secrets, Customer Data, and Inference Content survive for as long as the information remains protectable under applicable law. No broad "residuals" right applies that would undermine the protection of the Ledger, the Levers, or Recovea's methodology.

12.2. Exclusions and compelled disclosure. Standard exclusions (independently developed, publicly available without breach, rightfully received from a third party, or already known) apply. A party may disclose Confidential Information to the extent legally compelled, with prompt notice where lawful and reasonable cooperation to seek protective treatment.

13. Warranties and Disclaimers

13.1. Mutual authority. Each party represents that it has the authority to enter into these API Terms.

13.2. DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN A SIGNED ORDER FORM OR THE MASTER AGREEMENT, THE API AND ALL DEVELOPER RESOURCES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITH ALL FAULTS. TO THE MAXIMUM EXTENT PERMITTED BY LAW, RECOVEA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

13.3. No guarantee of savings, output, or availability. RECOVEA DOES NOT GUARANTEE ANY COST SAVINGS, FINANCIAL OUTCOME, UPTIME, AVAILABILITY, OR THE ACCURACY, QUALITY, FITNESS, OR RESULTS OF ANY PROVIDER OUTPUT. Any savings, cost, or efficiency figure is an estimate unless Recovea has expressly designated it as verified in writing. There is no contractual uptime or service-level commitment for the API at launch (best-effort; no service credits; no percentage), except as may be expressly stated in a separate SLA or Order Form. The fail-open design and the reversible base-URL exit (Section 5) are the operative reliability mechanisms, not warranties.

13.4. Third-party Providers. Recovea is not responsible for any Provider, Provider output, Provider availability, Provider charge, Provider content policy, or Provider acceptable-use enforcement. The Customer's relationship with each Provider is solely between the Customer and that Provider.

13.5. Beta and free features. Any beta, preview, evaluation, or free feature is provided AS IS with no warranty and may be changed or withdrawn at any time.

14. Limitation of Liability

14.1. Exclusion of indirect damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, OR FOR PROVIDER CHARGES OR TOKEN COSTS, OR FOR ANY LOST, FOREGONE, UNREALIZED, UNACHIEVED, OR EXPECTED SAVINGS, COST REDUCTIONS, OR EFFICIENCY GAINS (INCLUDING ANY DIFFERENCE BETWEEN AN ESTIMATED, MEASURED, OR VERIFIED FIGURE AND ANY OTHER FIGURE, AND ANY SAVINGS FOREGONE BECAUSE TRAFFIC PASSED THROUGH UNOPTIMIZED ON FAIL-OPEN OR BASELINE PASSTHROUGH), ARISING OUT OF OR RELATING TO THE API, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND HOWEVER SUCH DAMAGES ARE CHARACTERIZED, INCLUDING WHERE CONTENDED TO BE DIRECT.

14.2. General cap. SUBJECT TO SECTIONS 14.3 AND 14.4, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE API AND THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID BY THE CUSTOMER TO RECOVEA FOR THE API AND SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) US $25,000 (the "General Cap").

14.3. Super-cap. For (a) a party's breach of its confidentiality obligations and (b) a party's breach of its data-protection or security obligations (including under the DPA), each party's total aggregate liability will not exceed two (2) times (2×) the General Cap (the "Super-Cap"). The Super-Cap is symmetric and applies identically to both parties.

14.4. Uncapped claims. The General Cap and the Super-Cap do not apply to: (a) the Customer's payment obligations; (b) a party's indemnification obligations (except that Recovea's IP-infringement indemnity under Section 15.2 is subject to the General Cap in Section 14.2); (c) the Customer's breach of the license (Section 2.1), the AUP, or the IP-ownership and restriction terms (Sections 7, 8, and 11); and (d) a party's fraud or willful misconduct, in each case to the extent not waivable, together with any liability that cannot be limited under applicable law. A party's liability for gross negligence remains subject to the General Cap and the Super-Cap to the fullest extent permitted by applicable law; where, and only to the extent, applicable law does not permit liability for gross negligence to be so limited, such liability is limited to the maximum extent that law permits.

14.5. Allocation; essential purpose. The Customer acknowledges that these limitations and exclusions reflect an agreed allocation of risk, are a material basis of the bargain (including Recovea's $0 token-COGS, no-resale conduit posture), and apply even if a remedy fails of its essential purpose.

15. Indemnification

15.1. Customer indemnity. The Customer will defend, indemnify, and hold harmless Recovea and its affiliates, officers, and personnel from and against any third-party claim, and resulting losses, arising out of or relating to (a) the Customer's Inference Content, prompts, outputs, or data; (b) the Customer's use of the API in violation of these API Terms, the AUP, applicable law, or any Provider's terms; (c) the Customer's Provider accounts, Provider Keys, or Provider Charges; or (d) the Customer's downstream products, services, or end users.

15.2. Recovea IP indemnity. Recovea will defend the Customer against any third-party claim alleging that the Service as provided by Recovea, when used in accordance with these API Terms and the Documentation, infringes a US patent, copyright, or trade secret, and will indemnify the Customer against damages and reasonable costs finally awarded against, or agreed in a settlement approved by Recovea and payable by, the Customer for such claim. This indemnity does not apply to, and Recovea has no obligation for, any claim arising from: (a) Provider outputs, Provider models, or any Provider API; (b) Customer Content, Inference Content, Customer Data, or Provider Keys; (c) combinations or modifications not made by Recovea, or use of the Service in combination with items not provided by Recovea where the claim would have been avoided absent the combination; or (d) use outside the Documentation or in breach of these API Terms. As Recovea's sole obligation and the Customer's sole and exclusive remedy for any infringement claim, Recovea may, at its option: (i) procure the right for the Customer to continue using the Service; (ii) modify or replace the Service so it is non-infringing while substantially equivalent; or (iii) if (i) and (ii) are not commercially reasonable, terminate the affected access and refund prepaid, unused Fees for the affected Service. This indemnity is subject to the General Cap in Section 14.2.

15.3. Procedure. The indemnified party will give prompt notice, tender sole control of the defense (subject to the indemnified party's right to participate with its own counsel at its expense), and provide reasonable cooperation. No settlement imposing liability or admission on the indemnified party may be entered without its consent.

16. Suspension

16.1. Grounds. Recovea may suspend or restrict the Customer's or any Authorized User's access to the API, in whole or in part, immediately and with or without prior notice, if Recovea reasonably determines that: (a) there is a security, integrity, or availability risk to the API, Recovea, or any third party; (b) the Customer is in violation of these API Terms, the AUP, or applicable law; (c) a credential is or may be compromised; (d) the Customer's use threatens to cause runaway Provider spend or to harm a Provider relationship; (e) required by legal process or a Provider; or (f) the Customer's Fees are overdue.

16.2. Scope and restoration. Recovea will use reasonable efforts to narrowly tailor any suspension and to restore access promptly once the cause is resolved. Suspension does not relieve the Customer of its payment obligations and is without prejudice to Recovea's other remedies, including termination.

17. Term and Termination

17.1. Term. These API Terms apply for as long as the Customer accesses the API and remain in effect alongside the Master Agreement.

17.2. Termination. Either party may terminate API access in accordance with the Master Agreement, including for uncured material breach. Recovea may terminate or suspend API access immediately for the grounds in Section 16 or for the Customer's repeated or serious breach of these API Terms or the AUP.

17.3. Effect. Upon termination, the Customer must cease all use of the API, and all rcv_ keys are revoked. The Customer can redirect its base URL to its Provider's native endpoint to continue using its own Provider accounts directly. Sections that by their nature should survive — including the Definitions (Section 1), the BYO-Key conduit / no-resale / not-a-provider-party terms (Section 3), the fail-open and no-mid-stream-failover disclaimers (Section 5), and Sections 7.2-7.4, 8.1, 9.3, 10, 11-15, 17.3, and 18-20 — survive termination.

17.4. Data return/deletion. Return and deletion of Customer Data and the Ledger integrity carve-out are governed by the DPA and Retention documentation.

18. Dispute Resolution; Arbitration; Class-Action Waiver

18.1. Informal resolution. Before commencing a proceeding, the parties will attempt in good faith to resolve any dispute by negotiation for at least thirty (30) days after written notice to legal@recovea.ai (or to the Customer's account contact).

18.2. Binding arbitration. Except for the carve-outs in Section 18.4, any dispute arising out of or relating to these API Terms or the API will be resolved by final and binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, before one arbitrator, seated in Wilmington, Delaware. Because the API is a business-to-business, business-property service, the parties intend the AAA Commercial Arbitration Rules to apply, subject to the Agreement's Consumer-Rules fallback and mass-arbitration protocol (Terms of Service §24.2 and §24.7 / MSA §23.2 and §23.6): if the AAA or a court of competent jurisdiction determines that the AAA Consumer Arbitration Rules apply to a dispute involving an individual, those rules govern that dispute and Recovea pays the filing, administrative, and arbitrator fees the AAA consumer fee schedule assigns to the business. Judgment on the award may be entered in any court of competent jurisdiction.

18.3. Class-action waiver. TO THE MAXIMUM EXTENT PERMITTED BY LAW, DISPUTES WILL BE BROUGHT ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate claims or preside over any class or representative proceeding. If this waiver is held unenforceable as to a particular claim, that claim (and only that claim) will proceed in the courts identified in Section 18.4.

18.4. Carve-outs to court. Either party may (a) bring an individual claim in small-claims court if it qualifies and is within that court's jurisdiction, and (b) seek injunctive or other equitable relief for actual or threatened infringement or misuse of intellectual property or breach of confidentiality. Such matters, and disputes brought by non-contracting parties (for example, security researchers or trademark/IP complainants), are subject to the state and federal courts located in Wilmington, Delaware, and the parties consent to the personal jurisdiction and venue of those courts for those matters.

18.5. Fees. Each party bears its own attorneys' fees and costs, and arbitration fees are allocated, in accordance with the AAA Commercial Arbitration Rules, except as a tribunal or court may otherwise award.

19. Governing Law and Venue

These API Terms are governed by the laws of the State of Delaware, excluding its conflict-of-laws rules. The U.N. Convention on Contracts for the International Sale of Goods does not apply. For any matter carved out of arbitration under Section 18.4, the exclusive jurisdiction and venue are the state and federal courts located in Wilmington, Delaware, as stated in Section 18.4.

20. General

20.1. Incorporation. These API Terms are incorporated into and form part of the Master Agreement. Together with the AUP, DPA, BYO-Key Addendum, Privacy Notice, and any Order Form, they constitute the entire agreement regarding the API and supersede all prior or contemporaneous understandings on that subject.

20.2. Order of precedence. Conflicts are resolved per Section 0 and the Master Agreement.

20.3. Modification. Recovea may modify these API Terms from time to time. Recovea will post the updated version with a new "Last updated" date and, for material changes, provide reasonable notice (through the console, documentation, or email). Continued use of the API after the effective date constitutes acceptance. Where a signed Order Form or MSA governs, changes to these API Terms apply to the extent permitted by that agreement.

20.4. Assignment. The Customer may not assign or transfer these API Terms or any rcv_ key without Recovea's prior written consent, except to a successor in a merger or sale of substantially all assets that is not a competitor of Recovea and that assumes all obligations. Recovea may assign these API Terms to an affiliate or in connection with a merger, acquisition, or sale of assets. Any prohibited assignment is void.

20.5. Force majeure. Neither party is liable for any delay or failure (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, labor disputes, governmental action, internet or utility failures, Provider outages, and denial-of-service attacks.

20.6. Notices. Notices to Recovea must be sent to legal@recovea.ai and, where a physical address is required, to 2810 N Church St STE 89986, Wilmington, DE 19802. Notices to the Customer may be sent to its account contact or in-product. Security matters: security@recovea.ai; privacy matters: privacy@recovea.ai; abuse and general AUP matters: legal@recovea.ai; intellectual-property / DMCA notices: dmca@recovea.ai. This routing matches the Acceptable Use Policy §18, which is the canonical table.

20.7. Electronic signatures and communications. The parties consent to transact electronically; electronic acceptance, records, and signatures have the same effect as handwritten ones under the U.S. ESIGN Act and applicable state UETA.

20.8. Independent contractors. The parties are independent contractors; nothing creates a partnership, agency, joint venture, or fiduciary relationship.

20.9. No third-party beneficiaries. Except for indemnified parties under Section 15, there are no third-party beneficiaries.

20.10. Severability; waiver. If any provision is held unenforceable, it will be modified to the minimum extent necessary or severed, and the remainder will remain in effect. No waiver is effective unless in writing, and no failure to enforce is a waiver.

20.11. Export and sanctions. The Customer must comply with all applicable US export-control and sanctions laws and must not use the API in violation of them or on behalf of any restricted party or embargoed jurisdiction.

20.12. International transfers. International data-transfer mechanics, where applicable, live solely in the DPA or a standalone transfer addendum and are dormant for US-only operation; these API Terms make no independent transfer representation.

End of Recovea API & Developer Terms.