Developer & API Terms

These terms govern use of the Acosmi Open Platform, including the open API, Agent SDK, OAuth integrations, and legal-service APIs. They supplement the Terms of Service and apply to all developers building on Acosmi.

Applicable region: International (users outside mainland China). Users in mainland China should switch to the Simplified Chinese (China region) version.

Effective: June 3, 2026 | Last updated: June 3, 2026

1. Scope and Relationship to Other Agreements

These Developer & API Terms (the "Developer Terms") are a supplemental agreement to the Terms of Service (the "Main Terms"). All provisions of the Main Terms continue to apply in full. Where these Developer Terms conflict with the Main Terms on a developer-specific matter, these Developer Terms prevail.

The Acosmi open platform is operated under the Xiezhua group, consisting of two affiliated entities that together operate the unified "Acosmi" brand:

• Xiezhua (Beijing) Intelligent Technology Co., Ltd. — open platform operator and charging party for all API and SDK services;
• Hongshen (Beijing) Legal Consulting Co., Ltd. — provider of legal-service APIs including Bench (众律宝) and Trusted Timestamp (可信时间章).

Who these terms apply to. These Developer Terms apply to any individual, company, or other legal entity that:

1. Calls the Acosmi open API using an API key (prefixed sk-);
2. Integrates the Agent SDK (@acosmi/sdk-ts or any other official Acosmi SDK);
3. Builds third-party integrations, plugins, workflows, or automations on top of Acosmi services;
4. Registers an OAuth application to use "Sign in with Acosmi"; or
5. Uses the Sign, Evidence, Timestamp, or Bench legal-service APIs.

By accessing or using any of the above services you ("Developer") confirm that you have read, understood, and agree to be bound by these Developer Terms. If you are agreeing on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" and "Developer" refer to that entity.

2. Developer Account and Eligibility

2.1 Unified Account System

All developer credentials — API keys, OAuth client credentials, signing keys — are issued under a single unified Acosmi account. You do not need separate accounts for different product lines; everything is managed from the Acosmi developer console.

2.2 Eligibility Requirements

Providing false information during registration is a material breach of these Developer Terms and will result in immediate account suspension and may give rise to legal liability.

2.3 Identity Verification Tiers

Different features require different levels of verified identity:

• Basic API access (standard inference endpoints): phone-number verification; individual keys must be associated with a verified (contact-bound) account;
• Legal-service APIs (Sign / Evidence / Timestamp / Bench): enhanced personal or business identity verification;
• OAuth applications distributed to the public (third-party users authorising your app): company-level verification or individual filing, depending on scale. Note that enterprise verification for API key issuance is being connected and is not yet fully wired; contact us to confirm current requirements.

2.4 Account Security

You are entirely responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. If you become aware of any unauthorised access, you must notify us immediately at fuwu@acosmi.com or 4000269678 (400-026-9678).

3. API Keys — Issuance, Security, and Responsibility

3.1 API Key Format and Issuance

Acosmi authenticates open API requests using API keys prefixed with sk-. Keys are generated in the developer console, where you can configure:

• Display name and description;
• Permission scopes;
• IP allowlist restrictions (optional);
• Monthly or daily Credits spending limits (optional).

You may create multiple API keys under one account to support different environments, applications, or access-control requirements.

3.2 Confidentiality Obligations

API keys are sensitive credentials. You must:

1. Store API keys exclusively on the server side or in a dedicated secrets management system (environment variables, a vault, etc.) — never hard-code keys in client-side code, front-end source, or any public code repository;
2. Never share your API keys with unauthorised third parties;
3. Use .gitignore or an equivalent mechanism to prevent keys from being committed to version control;
4. Rotate keys regularly, and immediately when you suspect exposure;
5. Revoke compromised keys without delay via the developer console.

3.3 Responsibility for All Calls Under Your Key

You are fully responsible for every API call made using your keys, whether or not those calls were authorised by you. This includes:

• All Credits consumed under your keys;
• All content generated, transmitted, or received via your keys;
• Any harm caused to third parties as a result of calls made under your keys.

Acosmi does not issue refunds for Credits consumed as a result of a compromised key, but will cooperate reasonably in any investigation.

3.4 Revocation and Expiry

An API key becomes invalid when:

• You delete it in the console;
• Your account is closed or banned;
• Acosmi revokes it for policy violations;
• The key has not been used for 180 consecutive days (you will receive an email warning 14 days before automatic expiry).

4. Quotas, Rate Limits, and Fair Use

4.1 Default Rate Limits

We may apply per-key rate limits and quotas; some are being rolled out and not all limits are currently enforced. The values below are indicative reference points — the developer console always shows your current enforced limits in real time, and actual values may vary by plan or operating policy.

4.2 Rate-Limit Response Format

When a request exceeds a currently enforced limit, the API returns HTTP 429 Too Many Requests with a Retry-After header indicating when you may retry. The official SDK implements exponential back-off automatically; if you call the API directly you should implement equivalent retry logic.

4.3 Fair Use Policy

To ensure equitable service quality across all developers, the following behaviours are prohibited:

• Distributing load across multiple accounts to circumvent per-account limits;
• Sending burst traffic designed to exhaust shared infrastructure (DDoS-style patterns);
• Polling endpoints at a frequency with no genuine business justification;
• Any technical means designed to bypass quotas or rate limits.

Acosmi reserves the right to throttle, suspend, or permanently ban accounts that violate the fair use policy, and to recover costs caused by abusive usage.

4.4 Requesting Higher Limits

If your legitimate business needs exceed the default limits, submit a capacity increase request via the developer console or email fuwu@acosmi.com to discuss a custom arrangement.

5. Metered Billing in Credits

Read this section together with the Payment & Refund Policy, which contains specific pricing, plan details, and refund terms.

5.1 The Credits System

All open API usage is billed in Credits, a prepaid metered unit. Usage is calculated per request across multiple resource dimensions:

Exact rates are published on the developer console rate-card page and returned in the usage field of every API response. Acosmi reserves the right to adjust rates with at least 14 days' advance notice.

5.2 Prepaid Model

The open API operates on a prepaid basis:

1. You must load Credits into your account before making API calls;
2. Each API call triggers a pre-authorisation (Hold) against your balance;
3. When the call completes, usage is settled — the Hold is released and actual consumption is deducted;
4. If your balance is insufficient to cover a new Hold, the API returns HTTP 402 Payment Required and does not process the request.

5.3 Insufficient Balance Behaviour

5.4 Credits Validity

Validity periods for purchased Credits are stated at time of purchase. Subscription-plan Credits reset each billing cycle (monthly or annual) and do not roll over. Purchased Credits have no fixed expiry, but are forfeited on account closure (see Section 14 for account deletion). Before closing your account, we recommend applying for a refund of any unused purchased Credits under the Payment & Refund Policy.

5.5 Invoicing

Invoicing options vary by region. Enterprise customers may contact fuwu@acosmi.com to request receipts or formal invoices. Ensure your account billing details are accurate to avoid delays.

6. Acceptable Use and Prohibited Conduct

6.1 Governing Law Compliance

You must use the Acosmi open API in compliance with all applicable laws and regulations of your jurisdiction, including but not limited to:

• Data protection laws (see Section 7);
• Intellectual property laws;
• Export control and sanctions regulations;
• Consumer protection laws applicable to your end-user relationships;
• Any sector-specific regulations applicable to your application (healthcare, finance, legal services, etc.).

6.2 Prohibited Conduct

The following are expressly prohibited. Violations may result in immediate termination, recovery of damages, and referral to law enforcement:

Technical abuse:

• Reverse engineering, decompiling, disassembling, or attempting to extract the source code or weights of any Acosmi model or API infrastructure;
• Reselling or sub-licensing raw API capacity to third parties as an undisclosed intermediary, without Acosmi's written authorisation;
• Using the Acosmi API to train, fine-tune, or distil a competing foundation model or AI service;
• Scraping API responses at scale to build a dataset or to reconstruct model behaviour;
• Circumventing, disabling, or attacking Acosmi's safety filters, content classifiers, rate limiters, or authentication mechanisms;
• Using the API for automated vulnerability scanning, penetration testing, or denial-of-service attacks against Acosmi or any third party.

Content violations:

• Generating or facilitating the distribution of content that is illegal in your jurisdiction or Acosmi's operating jurisdictions;
• Using the API to conduct fraud, phishing, spamming, or social engineering attacks;
• Generating content that infringes third-party intellectual property rights without authorisation;
• Impersonating individuals, organisations, or government agencies.

Data violations:

• Submitting personal data of individuals who have not given appropriate consent for that data to be processed by an AI service;
• Transmitting data that you do not have the legal right to process;
• Using the API to process special categories of personal data (health, biometric, political opinions, etc.) without appropriate safeguards and a lawful basis.

6.3 Content Policy

All content generated via the API is subject to Acosmi's content policy (published separately in the developer console). Acosmi may implement automated and manual content filtering; you must not attempt to bypass these controls.

7. Data Protection and End-User Obligations

7.1 Role Allocation

When you use the Acosmi API to provide a service to your own end users:

• You act as the data controller (or independent processor, as applicable under your local law): you determine the purposes and means of processing your end users' personal data;
• Acosmi acts as your data processor (sub-processor, where relevant): Acosmi processes the data you send through the API only in accordance with your instructions and these Developer Terms.

This role allocation means primary compliance responsibility for your end users' personal data sits with you.

7.2 GDPR and International Data Protection

If you process personal data of individuals in the European Economic Area (EEA), United Kingdom, or other jurisdictions with comprehensive data protection laws, you must:

1. Establish a lawful basis for processing under GDPR Article 6 (and Article 9 for special categories) before transmitting any personal data to the API;
2. Provide a privacy notice to your end users that clearly discloses that their data will be processed by an AI service provider;
3. Minimise data: only transmit the minimum personal data necessary to achieve the intended purpose;
4. Data Processing Agreement (DPA): where GDPR applies, you must enter into a DPA with Acosmi before transmitting personal data. Contact fuwu@acosmi.com to request our standard DPA;
5. International transfers: if transferring personal data from the EEA/UK to Acosmi infrastructure outside those regions, ensure an appropriate transfer mechanism is in place (Standard Contractual Clauses or equivalent);
6. Data Subject Rights: you remain responsible for responding to your end users' data subject rights requests (access, erasure, portability, etc.). Acosmi will cooperate to the extent technically feasible.

7.3 Data You Must Not Send

Unless you have obtained specific written authorisation from Acosmi, do not transmit through the API:

• Government-issued identification numbers (passport numbers, national ID numbers, social security numbers);
• Payment card numbers (PAN) or full financial account credentials;
• Biometric data (facial recognition templates, fingerprints, voiceprints);
• Medical or health records that directly identify an individual;
• Personal data of children under the age of 16 (or the applicable minimum age in your jurisdiction) without verified parental consent;
• Classified or state-secret information.

7.4 Security Obligations

You must implement appropriate technical and organisational security measures within your application layer, including:

• Encrypted transmission of any sensitive data sent to the API;
• Access controls ensuring only authorised personnel and systems can trigger API calls involving personal data;
• Prompt notification to Acosmi at fuwu@acosmi.com if you discover a security incident involving data transmitted through our API.

7.5 Data Retention

Acosmi's retention policy for API request and response logs is set out in the Privacy Policy. You may not instruct Acosmi to retain data for longer than permitted under applicable law.

8. Acosmi as an OAuth Provider ("Sign in with Acosmi")

Read this section together with the OAuth Authorisation Policy, which contains the complete technical and compliance specification.

8.1 Registering an OAuth Client

OAuth integration ("Sign in with Acosmi") is currently available to first-party products and partner developers. Self-service OAuth client registration for third-party applications is being progressively opened. If you need to integrate OAuth, please contact us at fuwu@acosmi.com to register your redirect URIs and requested scopes; credentials will be issued following review.

Approved integrations receive:

• A Client ID (public identifier)
• A Client Secret (confidential credential — treat with the same care as an API key)

Required registration fields:

8.2 Handling Tokens

• Store access tokens and refresh tokens server-side only; never expose them to client-side code or browser storage;
• Do not use tokens to perform operations outside the scopes the user explicitly authorised;
• Honour token revocation immediately: when a user revokes access (via Acosmi account settings or your own UI), stop using their tokens;
• Implement refresh token rotation; do not refresh more frequently than necessary to avoid triggering rate limits.

8.3 User Data Restrictions

Data obtained through OAuth scopes (user ID, name, email, etc.) may only be used:

• For the specific purpose disclosed to the user at the time of authorisation;
• In accordance with your own published privacy policy;

You must not:

• Sell, rent, or transfer user data obtained via OAuth to third parties;
• Use OAuth-obtained data to train AI or machine-learning models;
• Retain user data after the user revokes authorisation, beyond any legally required minimum retention period.

9. Legal-Service APIs

9.1 Overview

The following APIs are provided by Hongshen (Beijing) Legal Consulting Co., Ltd. and are additionally subject to the E-Certification Service Agreement:

By calling any of these APIs you agree to both these Developer Terms and the E-Certification Service Agreement. In the event of conflict between the two, the E-Certification Service Agreement governs for legal-service-specific matters.

9.2 Additional Obligations for Legal-Service APIs

1. Legitimate purpose: legal-service APIs are intended for genuine legal or compliance use cases only; using them to manufacture false evidence or fraudulent documents is a criminal offence in most jurisdictions and will result in immediate termination and referral to authorities;
2. User disclosure: you must clearly inform your end users of the legal nature and binding effect of electronic signatures and timestamped records generated through your application;
3. Data authenticity: you must ensure that all documents and data submitted for signing, timestamping, or evidence preservation are genuine and that you have the legal right to submit them;
4. Regulatory licences: if you integrate legal-service APIs into a product providing legal services to the public, you are responsible for obtaining any required industry licences or regulatory approvals in your jurisdiction.

10. Intellectual Property and Branding

10.1 Licence to Use the API and SDK

Acosmi grants you a non-exclusive, non-transferable, revocable, limited licence to access and use the open API and the Agent SDK (@acosmi/sdk-ts) solely for the purpose of developing, testing, and operating applications that integrate with Acosmi in accordance with these Developer Terms. This licence does not permit you to:

• Modify, create derivative works of, distribute, or sublicence the API, SDK, or any underlying model;
• Provide services to third parties that are branded as or represented as Acosmi services;
• Make any representation that your application is endorsed, certified, or officially affiliated with Acosmi (beyond accurate attribution such as "Powered by Acosmi").

10.2 Your Application's IP

Code, content, and data that you independently create in your application (excluding the Acosmi API, SDK, and any model outputs) remain your intellectual property. With respect to AI-generated outputs, ownership is governed by the Main Terms and applicable law.

10.3 Brand and Logo Use

• You may include the text attribution "Powered by Acosmi" or "Built with Acosmi API";
• You may not use the Acosmi wordmark, logo, or any confusingly similar mark without prior written approval from Acosmi's marketing team;
• You may not use Acosmi branding in a way that implies an official partnership, certification, or endorsement;
• You may not apply to register any trade mark that incorporates the Acosmi name or logo.

To request brand use approval or brand assets, contact fuwu@acosmi.com.

10.4 Feedback Licence

If you provide Acosmi with suggestions, feedback, ideas, or improvements relating to the API, SDK, or any Acosmi service, you grant Acosmi a perpetual, irrevocable, worldwide, royalty-free, fully sub-licensable licence to use, reproduce, modify, distribute, and incorporate that feedback into its products and services, without any obligation to compensate you or to seek your further approval.

11. Service Levels, Changes, and Deprecation Policy

11.1 Availability Target

Acosmi will use commercially reasonable efforts to maintain high availability of the open API, targeting a monthly uptime of 99.5% or better, measured at the API gateway level. This target is provided as a statement of intent and does not constitute a legally binding service level agreement unless separately agreed in writing. Scheduled maintenance windows are announced in advance on the Acosmi status page.

11.2 API Versioning

Acosmi follows semantic versioning for its API surface:

11.3 Deprecation Process

When an API endpoint, parameter, model, or feature is deprecated:

1. It will be flagged as [DEPRECATED] in the official documentation;
2. A deprecation notice will be sent to the registered email address and posted in the developer console at least 90 days before the deprecation date;
3. After the deprecation date, the deprecated item enters a maintenance-only mode (functional but not improved or actively bug-fixed);
4. Deprecation items are removed entirely no earlier than 12 months after the deprecation date.

11.4 Emergency Changes

In the event of a critical security vulnerability, a legal compliance requirement, or force majeure, Acosmi may make emergency changes or disable specific endpoints without advance notice. Acosmi will communicate the reason to affected developers as promptly as practicable after the change.

11.5 Amendments to These Terms

Acosmi reserves the right to modify these Developer Terms at any time. Changes materially affecting developer rights or obligations will be notified at least 30 days in advance via the developer console and registered email. Continued use of the API after the notice period expires constitutes acceptance of the revised terms. If you do not accept the change, you must stop using the API and may contact fuwu@acosmi.com before the change takes effect.

12. Suspension, Termination, and Banning

12.1 Grounds for Immediate Suspension or Termination

Acosmi may, without prior notice, immediately suspend or permanently terminate your API access for:

1. Any violation of the prohibited conduct listed in Section 6;
2. A material breach of the Main Terms;
3. Fraud, money laundering, or other criminal conduct;
4. Large-scale scraping or abuse that degrades platform performance for other users;
5. A requirement or order from a competent regulatory or judicial authority;
6. Widespread abnormal activity under your API keys suggesting compromise (to protect your account, automated systems may auto-suspend pending investigation).

12.2 Graduated Enforcement

For less serious or first-time violations, Acosmi will generally apply graduated measures:

12.3 Developer-Initiated Termination

You may terminate these Developer Terms at any time by deleting all API keys and closing your account as described in Section 14.

12.4 Consequences of Termination

Upon termination (however arising):

• All API keys are immediately revoked;
• All OAuth client credentials are immediately invalidated; any third-party users who authorised your OAuth application will no longer be able to authenticate through it;
• Developer console data is handled per the Privacy Policy retention schedule;
• Unused purchased Credits are subject to the refund policy in the Payment & Refund Policy;
• Sections 7 (data protection), 10 (intellectual property), 13 (liability and indemnity), and any accrued payment obligations survive termination.

13. Warranties, Liability Limitation, and Indemnity

13.1 "As Is" Disclaimer

To the fullest extent permitted by applicable law, Acosmi provides the open API and SDK "as is" and "as available", without any representation or warranty, express or implied, including but not limited to:

• Warranties of merchantability, fitness for a particular purpose, or non-infringement;
• Any warranty that the API will be uninterrupted, error-free, or free of harmful components;
• Any warranty as to the accuracy, completeness, reliability, or timeliness of API outputs or model-generated content.

You acknowledge that AI-generated content may be inaccurate, incomplete, or inappropriate, and you bear sole responsibility for reviewing and validating outputs before acting on them or distributing them to end users.

13.2 Liability Cap

To the fullest extent permitted by applicable law, Acosmi's total cumulative liability to you for any claims arising under or related to these Developer Terms (whether in contract, tort, or otherwise) shall not exceed the total amount of API service fees you actually paid to Acosmi in the 12 months immediately preceding the event giving rise to the claim.

Acosmi shall not be liable for any:

• Indirect, incidental, special, exemplary, or punitive damages;
• Loss of profits, revenue, data, goodwill, or business opportunity;
• Damages arising from the actions of your end users or third parties;
• Damages arising from your reliance on AI-generated outputs.

13.3 Developer Indemnity

You agree to defend, indemnify, and hold harmless Acosmi, the Xiezhua group, and their respective officers, directors, employees, and partners from and against any claims, damages, losses, costs, and expenses (including reasonable legal fees) arising from or relating to:

• Your application and how it operates, including any harm it causes to third parties;
• Your end users' use of your application;
• Your violation of these Developer Terms or any applicable law or regulation;
• Content transmitted by your application that is unlawful, infringing, or harmful;
• Your failure to fulfil your data protection obligations to your end users;
• Any claim by a third party that your application infringes their intellectual property rights, privacy rights, or other legal rights.

14. Account Deletion

14.1 Effects of Deleting Your Account or Developer Access

Deleting your Acosmi account or revoking your developer access has the following irreversible consequences:

• All API keys are immediately revoked. Any in-flight API calls using those keys will be terminated;
• All OAuth client credentials (Client ID and Client Secret) are immediately invalidated. Any third-party applications relying on those credentials to authenticate end users via "Sign in with Acosmi" will cease to function;
• All API access stops. You will not be able to make any further API calls until or unless you create a new account;
• Developer data — including console configurations, usage statistics, and logs — is handled according to the retention schedule in the Privacy Policy. Some log data may be retained for a legally required minimum period; all other personal data will be deleted;
• Unused Credits are forfeited and will not be refunded after account closure is confirmed. We strongly recommend applying for a Credits refund before initiating account deletion, subject to the Payment & Refund Policy.

14.2 Deletion Channel

Account deletion is currently handled through customer support following identity verification; a self-service deletion path is being rolled out. To request deletion, use the contact details in Section 14.4 or refer to the Account Deletion Policy for the latest channel information. Once deletion is confirmed, an approximately 7-day cooling-off period begins during which you may cancel; after that period the deletion is irreversible.

14.3 Recommended Actions Before Deleting

• Download any Credits transaction history and invoices you may need for tax or accounting purposes;
• Notify any end users who rely on your OAuth application and migrate them to an alternative authentication method;
• Transfer OAuth application ownership to another account if you wish to preserve the integration;
• Apply for a refund of any unused purchased Credits balance before submitting the deletion request.

14.4 Full Details

For the complete account deletion procedure, including information on data handling timelines and how to request expedited deletion, see the Account Deletion Policy.

For assisted account deletion or if you encounter issues with the self-service process, contact us:

• Email: fuwu@acosmi.com
• Phone: 4000269678 (400-026-9678)

15. Amendments and Contact

15.1 How We Notify You of Changes

The current version of these Developer Terms is always available at the Acosmi legal documents page. Acosmi may update these terms from time to time. For changes that materially affect your rights or obligations, we will provide at least 30 days' advance notice via:

• A banner or notification in the developer console;
• An email to your registered address.

If you disagree with a change, please reach out before the effective date. Continued use of the API after the notice period constitutes your acceptance of the revised terms.

15.2 Related Agreements

15.3 Contact

Xiezhua (Beijing) Intelligent Technology Co., Ltd. (Operating as Acosmi — open platform operator and charging party)

• Support email: fuwu@acosmi.com
• Support phone: 4000269678 (400-026-9678) (Monday–Friday, 09:00–18:00 CST)
• Legal / compliance: legal@acosmi.com (where available)

Hongshen (Beijing) Legal Consulting Co., Ltd. (Legal-service API provider — Bench / Trusted Timestamp)

• Support email: fuwu@acosmi.com
• Support phone: 4000269678 (400-026-9678)