API terms

Three tiers — Free, Research and Commercial — with the current endpoints, rate limits and licence on the data and API page. Rate limits are per key and per minute, returned in response headers, and a 429 tells you when to retry rather than leaving you to guess.

We will give 90 days’ notice before a breaking change and will keep the previous version running for that period. Adding a field is not a breaking change; removing or renaming one is.

• Every surface that shows an evidence grade must show it as a LongLifeList grade, with a link to the page it came from and the date you retrieved it.
• You may not present a grade as your own rating, or blend it into a composite score without saying so.
• You may not show a grade without the accompanying grade meaning, because a bare letter is not usable information.
• The citation format is on the data page and is a licence condition, not a courtesy.

• Anything that gives an individual a diagnosis, a treatment recommendation, or a dose, presented as coming from us.
• A mirror of the dataset presented as an independent source.
• Training data for a model that reproduces our grades without attribution.
• Anything that presents an INSUFFICIENT or HARMFUL grade as a neutral or positive signal.

• Keys are secret, per environment, and yours to rotate. We store only a hash.
• Never put a key in client-side code. A key found in a public bundle is revoked without notice.
• The API never returns personal or health data about a member. There is no endpoint that could.
• Tell us within 72 hours if a key is exposed.

The Free tier is best-effort with no availability commitment. Research and Commercial tiers carry a published target and a status page. Nothing in the API is suitable as a dependency in a clinical workflow, and the terms will not be amended to make it so — including under a data processing agreement, because the data is published research appraisal, not patient care.