API access
API access may be provided through API keys, bearer sessions or other approved authentication mechanisms. Keys are issued to authorized merchant or developer workspaces and must not be shared publicly.
API Terms
This generic draft is not a signed service agreement. Production API access should be governed by an executed agreement and approved program terms.
Idempotency and request correlation
State-changing API calls should use Idempotency-Key when required by the contract. Responses may include request_id values for support and audit workflows.
Data restrictions
Do not submit full PAN, CVV, PIN, card secrets, production provider credentials, webhook secrets or raw sensitive payloads unless an approved production agreement and data handling process expressly permits it.
Security obligations
Users must protect API keys, rotate compromised credentials, restrict access to authorized users and promptly report suspected unauthorized access or vulnerabilities.
Rate limits and availability
AICardAPI may apply rate limits, abuse controls, maintenance windows and sandbox restrictions. Public documentation does not guarantee uptime, country coverage, provider support or transaction capacity.
Provider capability boundaries
Provider capability gates are internal controls. Unknown or unsupported provider paths fail closed and are not exposed as a merchant capability catalog in the MVP.
Testing and sandbox
Sandbox and demo identifiers are for integration testing only. They must not be used for real payment activity, real cardholder secrets or production reconciliation.