API agreement

1. Parties and scope

This agreement is between Sample Company Ltd (sample) Ltd, RC RC 0000000 (sample) ("KudiVend") and the business that uses the KudiVend API ("Client"). It applies alongside the Terms of use and the API documentation.

2. Sandbox and live access

• Sandbox keys (kv_test_…) work against sandbox.api.kudivend.com/v1, which is separate from production. No real value is delivered and no verification is needed.
• Live keys (kv_live_…) are issued only after the Client passes business verification (KYB): CAC certificate, director BVN and TIN.
• Orders are paid from the Client's prefunded KudiVend wallet. There is no credit.

3. Credentials and signing

• Each key's secret is shown once. The Client must store it securely, never put it in mobile apps or browser code, and rotate it if it may have leaked. Two keys can be active at once for rotation.
• Every request must be signed with HMAC-SHA256 as described in the documentation. The Client should restrict keys to its server IPs using the IP allowlist.
• Changes to keys, webhooks and IP allowlists are paused for 72 hours after a PIN reset or new-device sign-in on the owner's account.
• The Client is responsible for all orders made with its keys until it revokes them.

4. Idempotency and retries

Each order carries a request_id chosen by the Client. A request_id is unique per account forever. If the Client resends the same request_id with the same body, KudiVend returns the original order and does not charge again; with a different body it returns 409 idempotency_conflict.

The Client is responsible for reusing the request_id when it retries. KudiVend is not liable for duplicate orders created because the Client sent a new request_id for the same purchase. When an order is pending, the Client should use requery (at most once per minute per order) or wait for the webhook rather than placing a new order.

5. Rate limits

Default limits are 60 requests per second per key, and 60 verify requests per minute per key. Requests over the limit receive 429 with a Retry-After header. KudiVend may change limits to protect the service.

6. Webhooks and vouchers

• The Client must verify the signature on every webhook and ignore duplicates by event_id.
• Webhooks do not contain voucher values. Tokens and pins are fetched from the vouchers endpoint; every fetch is logged.
• The Client must keep vouchers confidential and deliver them only to the end customer who paid for them.
• After 10 failed delivery attempts an endpoint is disabled and the Client is emailed. Re-enabling it and replaying events is the Client's responsibility.

7. Prices and fees

There is no fee for API access beyond the product prices for the Client's price tier, which depends on 30-day volume. Prices may change at any time without notice; KudiVend sends a price.changed webhook and a daily email digest. Products may be paused when a provider is unreliable or a price is under review. See Fees.

8. Complaints and fraud duties

• The Client handles support for its own customers and must give them a way to complain.
• The Client must raise disputes with KudiVend from the order, with the order ID, within [DAYS] days of the order.
• The Client must apply reasonable fraud checks to its own customers, tell KudiVend at once about suspected fraud or account compromise, and answer KudiVend's fraud and recall queries within 24 hours.
• Where a funding transfer is recalled or an order the Client was refunded for is later delivered, KudiVend recovers the amount from the Client's wallet.

9. Acceptable use

The Client must not use the API to fund betting, gambling or lottery accounts, or resell to anyone who does; to process orders for fraudulent or stolen funds; to probe, load-test or attack production; or to resell API access itself without written consent.

10. Suspension and termination

KudiVend may throttle or revoke keys, pause the account, or hold the wallet balance while it investigates suspected fraud, abuse, a security risk, or a breach of this agreement, and will tell the Client the reason where the law allows. Either party may end this agreement with 30 days' written notice; any remaining balance is refunded to the Client's verified business bank account, minus amounts owed.

11. Liability, law and notices

The API is provided with reasonable care but without a guaranteed uptime unless agreed in writing; current service health is on the Status page. Neither party is liable for indirect losses. KudiVend's total liability is limited to the value of the orders involved in the claim. This agreement is governed by Nigerian law. Notices: [email protected] and the Client's verified email.