API Terms

1. Status

Nothing on this page is an offer to supply, an availability commitment or a service-level promise. Those come with a contract.

2. What these terms cover

These terms apply to any automated access to Throttle that we authorise: an API key, a token, a feed, a webhook or a scheduled export. They apply in addition to our Terms of service, and, where the response contains Throttle Data, in addition to the Data Licence.

Authorised access is the only automated access. Without a key issued by us, section 4.1 of the Terms of service applies and every automated request to throttle.toys is prohibited — including requests dressed as a browser.

3. Keys and credentials

• A key identifies you. Everything done with it is attributed to you and is your responsibility.
• Keep keys secret. Do not commit them to a repository, embed them in a mobile or browser application, put them in a URL, or share them outside the organisation they were issued to.
• One set of credentials per licensee, unless your agreement says otherwise. Do not create multiple accounts or keys to get around a limit.
• Tell us immediately at [email protected] if a key leaks. We will rotate it. We may rotate or revoke any key at any time for security reasons, and we will tell you when we do.
• Send a descriptive User-Agent identifying your application and a contact address, so a problem on either side can be traced to a person.

4. Rate limits and fair use

• Limits are published per plan and enforced by the server. Responses carry RateLimit-* headers, and an exceeded limit returns 429 with a Retry-After.
• Honour Retry-After, back off exponentially on 429 and 5xx, and do not retry a 4xx other than 429 without changing the request.
• Do not parallelise around a limit, rotate addresses or keys, or spread a single workload across several accounts.
• Sustained use far beyond your plan's shape — the polite equivalent of downloading the database one page at a time — is a breach even if no single limit is exceeded.
• Request only the fields and pages you need, and use incremental parameters where they exist. Our costs are your price rise.

5. Permitted use

Unless your agreement says otherwise, you may use the API to:

• look up listings, dealers, vehicles and market statistics for your own internal purposes;
• build internal tools, dashboards and analyses for your organisation;
• power a feature in your own product that displays individual results to your users with attribution and a link back, where your agreement grants that right;
• keep a short-lived cache for performance, within the limits in section 7.

Personal keys issued with a Throttle+ subscription are for that subscriber's own non-commercial use only. Powering a product, a client deliverable or anything with other users behind it needs an Enterprise agreement.

6. Prohibited use

You may not:

• resell, redistribute, sublicense or publish API responses in bulk, or expose the API through a proxy, wrapper or “free mirror”;
• use the API to build, train, populate or improve a competing listing index, price guide, valuation product or market-data service;
• reconstruct a substantial part of our database, whether by exhaustive enumeration, identifier iteration, or repeated small requests;
• attempt to re-identify any individual from any response, or link it to a person, household or device;
• use responses as a factor in a decision about a specific consumer's eligibility for credit, insurance, employment or housing — see section 8 of the Data Licence;
• scrape throttle.toys as a substitute for, or a supplement to, the API — having a key does not license crawling the website;
• send requests designed to test, probe or degrade the service, or to explore undocumented endpoints;
• misrepresent your identity or your application, or strip attribution from anything you display.

7. Caching, storage and attribution

• Cache for performance for up to 24 hours unless your agreement says otherwise. Respect Cache-Control where we send it.
• Store only what you need for the use your agreement permits. Do not build a permanent mirror. When your access ends, delete stored responses — section 16 of the Data Licence applies.
• Refresh or remove a listing that we mark sold, removed or corrected, within 24 hours of the change appearing in the API. A stale price shown under our name is a problem for both of us.
• Attribute anything you display: “Source: Throttle (throttle.toys)” with a link, and keep any attribution field we return alongside the data it belongs to.
• Photographs returned by the API are hotlink URLs pointing at a dealer's own server. Do not copy, re-host or cache the image bytes; we do not, and our promise at /bot depends on you not doing it either.

8. Availability, versions and deprecation

• The API is versioned in the path (/api/v1/…). Additive changes — a new field, a new endpoint, a new optional parameter — can land in a version at any time, so write clients that ignore unknown fields.
• A breaking change means a new version. We intend to support the previous version for at least 90 days after a successor ships, and to email key holders when the clock starts.
• Endpoints in beta are marked as such and may change or disappear with shorter notice.
• There is no service-level agreement unless your contract states one. We may perform maintenance, and we may rate-limit or shed load to keep the site up for everyone.

9. Suspension and termination

We may suspend or revoke access immediately where a key is compromised, where usage threatens the stability or security of the service, where an invoice is unpaid after notice, or where we reasonably believe sections 4, 6 or 7 have been breached. Where the problem is not urgent we will contact you first; where it is, we will contact you straight afterwards and tell you what we saw.

You may stop using the API at any time. On termination, stop calling, delete stored responses as section 7 requires, and remove any attribution that implies a current relationship.

10. Pricing and the waitlist

Pricing coming soon. We are not publishing a number, a range or a “starting at” before we know what the product is and what it costs to run. When it is set, it will be published here and on /pricing, in full, before anyone is asked to sign anything.

What the Enterprise API will be, as currently planned:

• bulk and incremental access to listings, dealers and the market statistics behind the site;
• higher rate limits, stable versioning, a written contract with a service level and support;
• scoped to the categories and regions you need, rather than an all-or-nothing firehose.

The waitlist is on /pricing: company, role, email, what you intend to use it for, expected volume and categories. We use it to size the product and to come back to you when there is something real — not for marketing email.

11. How this fits with our other terms

• Terms of service — the base agreement, including the no-scraping rule these terms are the exception to.
• Data Licence — governs what you may do with the data in a response: no resale, no re-identification, attribution, the FCRA restriction.
• Privacy Policy — API responses contain listing, dealer and aggregated market data. They do not contain other users' personal information, and no endpoint exposes the internal trust score or any other hidden per-user signal.
• Where an Order Form or master agreement conflicts with this page, that document controls.

12. Contact

API questions, key problems and enterprise enquiries: [email protected]. Security issues: same address, subject Security, and we will acknowledge quickly.