API Terms of Use

1. Who these terms cover#

These terms apply to anyone who uses the Tobie API or MCP server at https://api.tobie.team, directly or through an AI app or agent. "You" means the person or organization using the API. If you use the API for an organization, you accept these terms for it.

They sit alongside any agreement your organization has signed with Tobie. If the two conflict, that agreement wins.

2. Keep credentials confidential#

• API keys, OAuth tokens and webhook signing secrets are confidential. Keep them in a secret manager or environment variables, never in code, URLs, tickets or shared documents.
• Each credential is issued to you. Do not share it with another person or organization.
• You are responsible for the calls made with your credentials.
• If a credential may have leaked, revoke it right away and tell us at security@tobie.team.

3. Use the API as designed#

• Stay within the rate limits. Do not scrape, crawl or bulk-copy data beyond them, and do not use extra credentials to get around them.
• Do not try to reach data of another employer, another person, or anything outside your credential's scope. Tobie checks every request twice, and every attempt is logged.
• Do not probe or test the API's security except as our responsible disclosure guidance allows.
• Follow the Acceptable Use Policy, which is part of these terms.

4. Benefits answers are not professional advice#

Tobie explains benefits using plan-level documents. Its answers are not medical, legal, tax or financial advice. Do not use the API to make medical, legal or tax decisions about a person. For decisions, point people to their plan documents, their HR team or a qualified professional.

5. Respect employee privacy#

• Use employee data only for the benefits and HR purposes the employer approved.
• Keep only the data you need, and delete it when you no longer need it.
• Do not use the API to monitor, profile or single out individual employees.
• Do not send protected health information (PHI) to the API. Tobie does not process PHI through the API.

6. AI apps connected by employees#

An employee may connect an AI app, such as ChatGPT or Claude, to Tobie. Tobie controls what the API returns to that app. The app provider's own terms and privacy policy govern what the app does with it. Employers can limit which apps may connect; those controls are rolling out.

7. Suspension#

Tobie may suspend or revoke credentials, apps or access when we see abuse, a security risk, a breach of these terms, or a legal requirement. When we can, we will tell you first and work with you to fix the problem.

8. Changes#

• Changes to the API are announced in the changelog. Breaking changes never ship inside /v1: they come as a new major version, and the old one keeps working for at least six months.
• Changes to these terms are announced in the changelog too. Using the API after a change takes effect means you accept it.

9. Availability#

We post live checks on the status page. Unless your organization's agreement with Tobie says otherwise, the API comes with no uptime commitment.

10. Contact#

Questions about these terms: hello@tobie.team. Security reports: security@tobie.team.