API Terms of Use

1. Definitions

The following definitions apply throughout these API Terms of Use. Capitalized terms not defined herein shall have the meanings ascribed to them in the Kotova Terms of Service.

• "API" (Application Programming Interface) means the set of protocols, routines, tools, and endpoints made available by Kotova that enable authorized third parties to programmatically interact with Kotova's platform, access data, and execute transactions in accordance with these API Terms of Use and the accompanying Documentation.
• "API Key" means the unique cryptographic credential issued by Kotova to an authorized Client upon successful registration, which serves as the primary means of authentication and identification when accessing the API. Each API Key is confidential and non-transferable.
• "Rate Limit" means the maximum number of API requests that a Client is permitted to make within a defined time period, as specified in the Documentation. Rate Limits are imposed to ensure fair usage, maintain platform stability, and prevent abuse of the API infrastructure.
• "Endpoint" means a specific URL path exposed by the API through which a Client may submit requests to access particular data or invoke particular functionality of the Kotova platform, as described in the Documentation.
• "Response" means the data, status codes, headers, and any other information returned by the API to a Client following the submission of a valid request to an Endpoint, formatted in accordance with the specifications set forth in the Documentation.
• "Client" means any natural or legal person who has been issued an API Key by Kotova and is authorized to access and use the API in accordance with these API Terms of Use. The term "Client" includes, where applicable, the Client's employees, contractors, and authorized agents acting on the Client's behalf.
• "Partner" means a Client who has entered into a separate written agreement with Kotova granting enhanced API access, elevated Rate Limits, or additional privileges beyond those available under the standard API Terms of Use. Approval of API access, or of a higher Rate Limit or commission rate, in the Kotova account does not by itself make a Client a Partner.
• "User Data" means any data relating to an identified or identifiable natural person that is transmitted to, processed by, or received from the API in the course of the Client's use of the API, including but not limited to personal identifiers, transaction data, wallet addresses, and any other information that constitutes personal data under applicable data protection legislation.
• "Documentation" means the official technical documentation, guides, reference materials, changelogs, and specifications published by Kotova that describe the functionality, Endpoints, request formats, Response structures, Rate Limits, authentication procedures, and best practices for using the API.
• "Kotova X" means the non-custodial cryptocurrency exchange aggregation service operated by Kotova, as defined in the Kotova Terms of Service, including access to it through the API.
• "Source" means an external counterparty, liquidity provider or decentralized protocol connected to Kotova X that executes exchange orders. The Source of each Quote and Order is identified in the Response.
• "Quote" means an offer returned by the API for a specific pair of assets, amount and rate type, naming the Source that would execute it and, where applicable, the alternative Sources (the Quote's fallback sources) to which the Order may fall back. A Quote is valid only until the expiry stated in the Response.
• "Order" means an exchange order created through the API on the basis of a Quote and executed by the Source named in that Quote or, where the Order falls back to it, by one of the alternative Sources named in that Quote.
• "Integration" means any application, website, wallet, service or system of the Client that uses the API.
• "End User" means any natural or legal person who uses the Integration to request a Quote or to place an Order.
• "Affiliate Profile" means the Client's profile in the Kotova Affiliate Program, as defined in the Kotova Affiliate Program Terms, to which the Client's API Key is linked.

2. Using the API

Access to the Kotova API requires a valid API Key. API Keys are created in your Kotova account. Creating an API Key requires a Kotova account with two-factor authentication enabled, an active Affiliate Profile, and your acceptance of these API Terms of Use and the Kotova Terms of Service. Each account may hold one active API Key at a time, and the secret part of a key is shown only once, when it is created. Kotova reserves the right to refuse, restrict or revoke API Keys at its sole discretion, without obligation to provide reasons.

You are solely responsible for maintaining the confidentiality and security of your API Key. Your API Key must be treated as highly sensitive credential information and must not be shared with, disclosed to, or made accessible to any unauthorized third party. You shall implement appropriate technical and organizational measures to protect your API Key from unauthorized access, including but not limited to encryption at rest, secure transmission protocols, and restricted access controls within your organization.

All API requests must comply with the specifications, formats, protocols, and procedures set forth in the Documentation. You are responsible for ensuring that your integration conforms to the current version of the Documentation and that your systems are updated to reflect any changes published by Kotova. Kotova shall not be liable for any errors, failures, or data loss resulting from non-compliant API requests or outdated integrations.

The API is subject to Rate Limits as specified in the Documentation. The Rate Limit for requests made with an API Key applies per account, not per API Key, so creating a new API Key does not reset it; requests to Endpoints that require no API Key, and failed authentication attempts, are limited per IP address as described in the Documentation. You must design your Integration to respect the applicable Rate Limits and any order limits described in the Documentation at all times. Requests that exceed them are rejected as described in the Documentation, and repeated or deliberate attempts to exceed or circumvent them may result in temporary throttling or suspension of your API Key. If your Integration requires a higher Rate Limit, you may request one in your account; Kotova decides on such requests at its discretion.

Kotova may release updated versions of the API from time to time. When a new version is released, Kotova will provide reasonable notice of the deprecation timeline for the prior version as described in Section 8. You are responsible for migrating your integration to the latest supported version within the deprecation period. Continued use of a deprecated API version after the end of its support period is at your own risk and may result in degraded functionality or loss of access.

You shall not use the API for any purpose that is unlawful, fraudulent, or prohibited by these API Terms of Use, the Kotova Terms of Service, or any applicable law or regulation. You shall not attempt to circumvent, disable, or interfere with any security, authentication, rate-limiting, or access control mechanisms implemented by Kotova in connection with the API.

3. Rights and Limitations

Subject to your compliance with these API Terms of Use, Kotova grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the API solely for the purposes described in the Documentation and in accordance with the scope of authorization granted to your API Key. This license does not confer any ownership rights in the API, its underlying technology, or any intellectual property of Kotova.

You shall not sublicense, sell, resell, lease, rent, distribute, or otherwise make available the API or any API Key to any third party without the prior written consent of Kotova. You shall not grant any third party direct or indirect access to the API using your API Key, except to the extent that such access is provided to your authorized employees or contractors who are bound by confidentiality obligations at least as restrictive as those set forth in these API Terms of Use.

You shall not reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, algorithms, data structures, or underlying architecture of the API or any component thereof. You shall not modify, adapt, translate, or create derivative works based on the API or any part thereof, except to the extent expressly permitted by the Documentation or by mandatory applicable law that cannot be excluded by contract.

You shall not engage in any abusive, excessive, or anomalous usage patterns that may degrade the performance, availability, or security of the API or the Kotova platform. This includes but is not limited to automated scraping of data beyond the scope of your authorized use, deliberate overloading of Endpoints, submission of malformed or malicious requests, or any activity that could be reasonably construed as a denial-of-service attack or an attempt to exploit vulnerabilities in the API infrastructure.

Kotova reserves the right to revoke, suspend, or restrict your access to the API at any time, with or without prior notice, if Kotova determines in its sole discretion that your use of the API violates these API Terms of Use, poses a security risk, adversely affects the performance or integrity of the platform, or is otherwise detrimental to Kotova or its users.

All data, content, and information made available through the API, including but not limited to exchange rates, market data, transaction records, and platform metadata, remains the exclusive property of Kotova or its licensors. You are granted a limited right to use such data solely in connection with your authorized use of the API. You shall not cache, store, redistribute, or commercially exploit API data except as expressly permitted by the Documentation or by a separate written agreement with Kotova. Notwithstanding the preceding sentence and subject to Sections 7 and 11, you may store the data of your Orders that you receive through the API, such as each Order's identifier, amounts, addresses, status and transaction details, to provide your Integration to End Users, for support, for your accounting and to comply with your legal obligations, including those described in Section 5.

4. Attribution and Display Requirements

Wherever your Integration presents a Quote or an Order obtained through the API to End Users, including the offer, the confirmation step, the Order's status view and any receipt or order history that lists it, you must identify Kotova X as the provider of the service by displaying the name "Kotova X", exactly as written and untranslated, together with the Kotova X icon as supplied through the API or the Documentation. You may resize the icon, but not below the minimum size stated in the Documentation, and you must not alter, recolor, rotate or distort it, combine it with other marks, or display the name or the icon without the other.

Before an End User confirms an Order, and before the Order is created, your Integration must display the source notice that the API returns with the Quote the End User is confirming. The notice names the Source and links to the terms that apply to the Order: the Source's own terms or, for a Source without terms of its own, such as a decentralized protocol, the Kotova Terms of Service. You must display it verbatim, with its link, in a clearly visible position before the End User confirms the Order, as described in the Documentation. You must not hide, shorten, reword or translate the notice, pre-accept it on the End User's behalf, or display it only after the Order has been created. Where the API provides the notice in the End User's language, you shall use that version. Unless you disable the fallback to alternative Sources when you create the Order (by sending retry_next_best_source: false, as described in the Documentation), the same applies to the source notices that the API returns with the Quote for those alternative Sources, except that you may display them after the notice of the Source named in the Quote, including in an expandable section placed directly next to it, as described in the Documentation.

You must not describe or present Kotova, Kotova X or yourself as the party that executes the exchange, and you must not suggest that Kotova endorses or sponsors your Integration or is affiliated with you beyond your use of the API. The party that executes the exchange is always the Source named in the source notice.

The Documentation describes these requirements in detail and may add requirements for particular Sources. Displaying Source names and logos beyond the source notice is optional; where the API returns no logo for a Source, you must not display that Source's logo. Logos and other marks of Sources remain the property of their respective owners. Kotova grants no licence to them; if you display them, you do so at your own risk, unmodified, only to identify the Source and without suggesting that the Source endorses your Integration. Kotova may require you to stop displaying any of them at any time.

Quotes are indicative and valid only until the expiry stated in the Response. You must not present an expired Quote as available. Where the Documentation describes Quote or Order amounts as indicative, in particular for variable-rate Orders, you must present them as estimates and not as guaranteed amounts.

Kotova may review how your Integration displays Kotova X and Source information. On request, you shall provide access to, or screenshots of, the relevant screens without undue delay. If your Integration does not comply with this Section, Kotova may suspend your API Key until it does.

5. Orders, End Users and Sources

Each Order is executed, under that Source's terms, by the Source named in the Quote on which it is based or, if that Source cannot create the Order and you have not disabled the fallback, by the next alternative Source named in the Quote that can. Kotova X is non-custodial: End Users send their deposit to the deposit address that the Source issues for the Order, Kotova never receives or holds the funds, and the Source sends the payout or any refund. The Kotova Terms of Service apply to every Order created through the API in the same way as to an order placed on Kotova X directly, except for features that the Documentation describes as unavailable for Orders created through the API, such as e-mail notifications to End Users or saving an Order to a Kotova account.

You are responsible for your Integration and for your relationship with your End Users. In particular, you shall:

• make the Kotova Terms of Service and the Kotova Privacy Policy available to End Users before they place an Order, and inform them that their Order data is transmitted to Kotova and to the Source that executes the Order;
• not offer Quotes or Orders to persons who are excluded from using Kotova X under the Kotova Terms of Service or from using the executing Source under its terms, including persons subject to sanctions or located in excluded jurisdictions;
• transmit only accurate data, in particular only receiving and refund addresses that the End User has provided or confirmed, and, where you transmit an End User's IP address, only the genuine IP address of the End User making the request;
• not create Orders without an End User who genuinely intends to fund them, in particular not to generate commission, to test load, or to obtain deposit addresses without a genuine exchange; creating a small number of Orders to test your Integration, as described in the Documentation, is permitted;
• keep the records you hold about each Order and the End User who placed it for as long as applicable law requires, and cooperate with reasonable requests from Kotova, a Source or a competent authority relating to an Order, including requests made to comply with anti-money-laundering obligations.

Order statuses, order limits, refunds and the handling of exceptional situations, such as a deposit outside the accepted range or a delayed payout, are described in the Documentation. Kotova makes each Order available through the API for 90 days after the Order is created, subject to Section 8; after that period the Order is archived and the API no longer returns it. Kotova may archive an Order earlier or keep it available for longer. The API is not an archive of your Orders: if you need an Order's data after it is archived, you must keep your own records of it, as permitted by Section 3 and subject to Section 7. Every Order also has a page on Kotova X that the End User can open with the Order's receiving address for 90 days after the Order is created, to follow the Order and, where the Source offers a choice, to choose how an exceptional situation is resolved. Not every exceptional situation offers such a choice. You shall not prevent End Users from using the page.

Kotova does not guarantee that a Source will accept or complete an Order. A Source may delay, refuse, refund or review an Order in accordance with its own terms, including for compliance reasons, and Kotova is not liable for such decisions of a Source.

6. Fees and Commissions

Use of the API is free of charge. Your API Key is linked to your Affiliate Profile. Orders created with your API Key are attributed to that Affiliate Profile and earn commission under the Kotova Affiliate Program Terms, at the commission rate shown in your account. End Users do not become your Referrals by placing Orders through the API. You may request a higher commission rate in your account; Kotova decides on such requests at its discretion.

Refunded Orders and Orders that breach these API Terms of Use earn no commission, and Kotova may withhold or reverse commission for them in accordance with the Kotova Affiliate Program Terms. If your Affiliate Profile is deactivated, your API Key stops working for as long as the deactivation lasts, and Orders completed during that time earn no commission. If your Affiliate Profile is closed, your API Key is revoked.

7. Privacy and Confidentiality

You acknowledge and agree that your use of the API may involve the processing of User Data. You shall handle all User Data in strict compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG"), and all other applicable data protection and privacy laws and regulations. You shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage of User Data.

You shall not share, disclose, or make accessible your API Key to any unauthorized third party under any circumstances. Your API Key is a confidential credential that uniquely identifies your account and grants access to the API. Any unauthorized use of your API Key, whether resulting from your negligence or a security breach, is your sole responsibility. If you become aware or suspect that your API Key has been compromised, disclosed to an unauthorized party, or used without your authorization, you must revoke it in your account immediately and notify Kotova at api@kotova.io.

You shall not store, retain, or persist User Data obtained through the API beyond the period strictly necessary for the fulfillment of the specific purpose for which the data was collected. You shall establish and maintain data retention and deletion policies that comply with the principle of data minimization as prescribed by the GDPR. Upon termination of your access to the API, or upon request by Kotova, you shall promptly and permanently delete all User Data in your possession or control that was obtained through the API. This Section and Section 11 do not require you to delete User Data to the extent that applicable law requires you to retain it, including the records described in Section 5.

In the event of a personal data breach, as defined under Article 4(12) of the GDPR, involving User Data obtained through or processed in connection with the API, you shall notify Kotova without undue delay and in any event no later than twenty-four (24) hours after becoming aware of the breach. The notification shall include, at a minimum, a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to be taken to address the breach and mitigate its effects.

All non-public information relating to the API, including but not limited to technical specifications, security protocols, internal documentation, business processes, and any information designated as confidential by Kotova, constitutes confidential information. You shall not disclose, publish, or disseminate any confidential information to any third party without the prior written consent of Kotova, and you shall use such information solely for the purpose of exercising your rights and fulfilling your obligations under these API Terms of Use.

For personal data of End Users that you transmit to Kotova through the API, you and Kotova each act as independent controllers. You are responsible for having a legal basis for transmitting such data, including an End User's IP address, and for providing End Users with the information required by applicable data protection law.

8. Availability and Support

Kotova shall use commercially reasonable efforts to maintain the availability of the API. However, the API is provided without any service level agreement (SLA), and Kotova does not guarantee any specific level of uptime, availability, or performance. The API may be subject to scheduled and unscheduled downtime, including but not limited to maintenance windows, infrastructure upgrades, security patches, and emergency repairs.

Kotova will endeavor to provide advance notice of scheduled maintenance windows that are expected to result in significant API downtime. Where practicable, such notice will be communicated through the Documentation, status page, or by email to registered Clients. However, Kotova reserves the right to perform emergency maintenance without prior notice when necessary to protect the security, integrity, or availability of the platform.

Kotova may deprecate or discontinue any API version, Endpoint, or feature at any time. In the event of a planned deprecation, Kotova shall provide at least thirty (30) days' prior written notice to affected Clients, specifying the deprecation date, the affected components, and, where applicable, the recommended migration path to a successor version or Endpoint. After the expiration of the deprecation notice period, the deprecated API version, Endpoint, or feature may be removed without further notice, and Kotova shall have no obligation to continue supporting it.

Technical support for the API is provided on a reasonable-efforts basis through the channels designated in the Documentation. Kotova does not guarantee response times or the resolution of technical issues within any specific timeframe. Partners with a separate written agreement may be entitled to enhanced support levels as specified in their agreement.

9. Warranty Disclaimer

The API is provided "as is" and "as available," without warranty of any kind, whether express, implied, statutory, or otherwise. To the fullest extent permitted by applicable law, Kotova expressly disclaims all warranties, including but not limited to implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, reliability, and timeliness.

Kotova does not warrant that the API will be uninterrupted, error-free, secure, or free of viruses or other harmful components. Kotova does not warrant that the data, exchange rates, market information, or any other content made available through the API will be accurate, complete, current, or reliable. You acknowledge that cryptocurrency markets are inherently volatile and that data provided through the API may be subject to delays, inaccuracies, or discrepancies.

Kotova does not warrant that the API will meet your specific requirements, that any defects or errors will be corrected, or that the API will operate in combination with any other hardware, software, systems, or services. You assume all risk and responsibility for your use of the API and for any decisions made or actions taken based on data or functionality provided by the API.

No advice, information, or representation obtained from Kotova or through the API, whether oral or written, shall create any warranty not expressly stated in these API Terms of Use. This disclaimer of warranties applies to the fullest extent permitted by law and shall survive the termination or expiration of these API Terms of Use.

10. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall Kotova, its partners, directors, employees, agents, or affiliates be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages arising out of or in connection with your access to or use of the API, including but not limited to damages for loss of profits, loss of revenue, loss of data, loss of business opportunities, business interruption, or loss of goodwill, regardless of the theory of liability (whether in contract, tort, negligence, strict liability, or otherwise) and even if Kotova has been advised of the possibility of such damages.

To the extent that Kotova's liability cannot be excluded under applicable law, Kotova's total aggregate liability to you for all claims arising out of or in connection with these API Terms of Use and your use of the API shall not exceed the total amount of fees actually paid by you to Kotova for the use of the API during the twelve (12) month period immediately preceding the event giving rise to the claim. If no fees have been paid, Kotova's maximum aggregate liability shall not exceed one hundred euros (€100).

The limitations of liability set forth in this section shall apply to the fullest extent permitted by law and shall survive the termination or expiration of these API Terms of Use. You acknowledge that these limitations are a material inducement for Kotova to provide the API and that Kotova would not make the API available without these limitations.

11. Term and Termination

These API Terms of Use are effective from the date on which you first access or use the API and shall remain in effect until terminated by either party in accordance with this section. Your continued use of the API constitutes ongoing acceptance of and agreement to be bound by these API Terms of Use, as amended from time to time.

Kotova may suspend or terminate your access to the API and revoke your API Key immediately, without prior notice and without liability, if Kotova determines in its sole discretion that:

• You have violated any provision of these API Terms of Use, the Kotova Terms of Service, or any other applicable Kotova policy.
• Your use of the API poses a security risk to the Kotova platform, its infrastructure, or its users.
• Your use of the API is causing or is reasonably likely to cause harm, disruption, or degradation to the performance or availability of the API or the Kotova platform.
• You are using the API in connection with any unlawful, fraudulent, or abusive activity.
• Continued provision of the API to you is no longer commercially viable or is required to be discontinued due to changes in applicable law or regulation.

You may terminate your use of the API at any time by ceasing all use of the API and deleting your API Key. You may also request the formal closure of your API account by sending written notice to legal@kotova.io.

Upon termination, whether initiated by you or by Kotova, your license to access and use the API shall immediately cease. You shall promptly delete, destroy, or return all API Keys, confidential information, and User Data in your possession or control that were obtained through the API. Termination shall not relieve you of any obligations incurred prior to the effective date of termination, including any obligations relating to the payment of fees, the protection of confidential information, and compliance with data protection requirements. Sections 1, 3, 5, 7, 9, 10, 12, and 13 of these API Terms of Use shall survive termination.

12. Applicable Law

These API Terms of Use are governed by and shall be construed in accordance with the laws of the Federal Republic of Germany, without regard to its conflict of law principles. The application of the United Nations Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded.

Any dispute, controversy, or claim arising out of or in connection with these API Terms of Use, including disputes regarding its existence, validity, interpretation, performance, breach, or termination, shall be subject to the exclusive jurisdiction of the competent courts of Hamburg, Germany. You irrevocably consent to the personal jurisdiction and venue of such courts and waive any objection on grounds of inconvenient forum or lack of jurisdiction.

Notwithstanding the foregoing, Kotova retains the right to seek injunctive or other equitable relief in any court of competent jurisdiction to prevent or restrain any actual or threatened violation of these API Terms of Use, particularly where such violation involves unauthorized access to the API, misuse of confidential information, or infringement of Kotova's intellectual property rights.

13. Miscellaneous

These API Terms of Use, together with the Kotova Terms of Service, the Kotova Affiliate Program Terms, the Kotova Privacy Policy and the Documentation, constitute the entire agreement between you and Kotova with respect to your access to and use of the API, and supersede all prior or contemporaneous oral or written communications, proposals, representations, and agreements with respect to the subject matter hereof. If the Documentation conflicts with these API Terms of Use, these API Terms of Use prevail.

Kotova reserves the right to modify, amend, or update these API Terms of Use at any time. Material changes will be communicated to Clients through the Documentation, by email to the address associated with their API Key, or through other reasonable means. Your continued use of the API following the effective date of any amendment constitutes acceptance of the revised API Terms of Use. If you do not agree with the amended terms, you must immediately cease all use of the API and delete your API Key.

If any provision of these API Terms of Use is found to be invalid, unlawful, void, or unenforceable by a court of competent jurisdiction, that provision shall be deemed severed from these API Terms of Use, and the remaining provisions shall continue in full force and effect. The invalid or unenforceable provision shall be reformed to the minimum extent necessary to make it valid and enforceable while preserving the original intent of the parties as closely as possible.

You may not assign, transfer, delegate, or sublicense any of your rights or obligations under these API Terms of Use to any third party without the prior written consent of Kotova. Any purported assignment or transfer in violation of this provision shall be null and void. Kotova may freely assign or transfer its rights and obligations under these API Terms of Use without restriction.

The failure of Kotova to enforce any right or provision of these API Terms of Use shall not constitute a waiver of such right or provision. No waiver by Kotova shall be effective unless made in writing and signed by an authorized representative of Kotova.

For any questions, concerns, or inquiries regarding these API Terms of Use or the Kotova API, please contact our legal team at legal@kotova.io.