Developer Terms and Conditions

Last updated: March 1, 2025

These Developer Terms and Conditions ("Developer Terms") govern your use of the Formaya API, Embed SDK, webhooks, and other developer tools (collectively, "Developer Tools"). These Developer Terms supplement our Terms of Use and form part of your agreement with Formaya.

1. API Access

Access to the Formaya API requires authentication via API keys. API keys are generated from your workspace settings and are scoped with specific permissions. You are responsible for:

  • Keeping your API keys secure and confidential
  • Not sharing API keys in public repositories, client-side code, or unprotected environments
  • Rotating keys immediately if you suspect they have been compromised
  • Using the minimum required scopes for your integration

2. API Key Scopes

API keys can be configured with the following permission scopes:

  • forms:read — Read form definitions, fields, and settings
  • forms:write — Create, update, publish, and delete forms
  • responses:read — Read and export form responses
  • responses:write — Submit and delete form responses
  • webhooks:read — List webhooks and delivery history
  • webhooks:write — Create, update, and delete webhooks

You should follow the principle of least privilege and only request scopes necessary for your integration's functionality.

3. Rate Limits

API usage is subject to rate limits to ensure fair usage and service stability. Current limits include:

  • Form response submissions: 5 per minute per IP per form
  • General API endpoints: subject to fair use limits based on your plan

Exceeding rate limits will result in HTTP 429 responses. Implement exponential backoff in your integrations. We reserve the right to adjust rate limits and will provide advance notice of material changes.

4. Embed SDK

The Formaya Embed SDK allows you to embed forms on external websites. When using the Embed SDK:

  • Forms are rendered in an iframe for isolation and security
  • Three embedding modes are available: inline, popup, and slider
  • You may customize the appearance through supported configuration options
  • You must not modify, decompile, or reverse-engineer the embed script
  • The embed script is loaded from Formaya's servers and must not be self-hosted or redistributed

5. Webhooks

Formaya can send event notifications to your configured webhook endpoints. When using webhooks:

  • Webhook payloads are signed with HMAC-SHA256 using your webhook secret
  • You should verify the signature on all incoming webhooks — preferably X-Formaya-Signature-V2 together with X-Formaya-Timestamp, which protects against replayed deliveries; the original X-Formaya-Signature header is kept for compatibility
  • Your endpoint must respond with a 2xx status code within 30 seconds
  • Webhooks that consistently fail will be automatically disabled after repeated failures
  • You are responsible for the security of your webhook receiving endpoints
  • Webhook payloads may contain Personal Data — handle them in accordance with applicable privacy laws

6. Acceptable Use

When using Developer Tools, you agree not to:

  • Circumvent or attempt to circumvent rate limits or usage quotas
  • Use the API to build a competing service or replicate core Formaya functionality
  • Access data belonging to other workspaces or users
  • Use automated means to create accounts, forms, or submit responses for spamming purposes
  • Interfere with or degrade the performance of the API or Service
  • Store API keys in client-side code, mobile apps, or any publicly accessible location

7. Data Handling

When accessing form response data through the API or webhooks, you become a data processor or controller (depending on your use case) and must comply with applicable data protection laws. See our Data Processing Agreement for details.

8. API Changes and Versioning

We may update or modify the API over time. We will make reasonable efforts to maintain backward compatibility and provide advance notice of breaking changes. Deprecated endpoints will remain available for at least 90 days after deprecation notice.

9. Service Level

We aim to maintain high availability of our API but do not guarantee specific uptime percentages for the free plan. Paid plans may include SLA commitments as specified in your plan details. Planned maintenance windows will be communicated in advance.

10. Termination

We may revoke your API access if you violate these Developer Terms, abuse the API, or pose a security risk. Upon termination, all active API keys for your workspace will be immediately revoked.

11. Contact

For developer-related questions or API support, contact us at [email protected].

Formaya — Conversational Form Platform