API Terms

1. What this covers

These API Terms govern the TeachMusic REST API, our webhooks, and any API key or token we issue you. They sit on top of the Terms of Service, which continues to apply in full. Where the two disagree about the API, this document wins.

If you have not been issued an API key, this document does not apply to you.

2. Who can use it

The API is available to teachers and schools with an active TeachMusic subscription, for their own studio data. A key is issued to an account and belongs to the organisation that account belongs to.

You may build on the API for your own studio, or on behalf of a studio that has asked you to. You may not resell access to it.

3. Your data is yours, and so is the export

The API exists because of a commitment in clause 18 of the Terms of Service: your students and your records are yours, and you can get them out any time, in full, for free. The API is one of the ways we keep that promise. The others are one-click CSV export from every table and, if you would rather we just did it, an email to support.

We will not degrade the export, put it behind a higher tier, or make leaving harder than joining.

4. Keys and security

• A key authenticates as your organisation. Treat it like a password.
• Keep keys server-side. Never put one in a mobile app, a browser bundle or a public repository.
• You are responsible for what happens under your key until you tell us it is compromised.
• Tell us immediately at support@teachmusic.com.au if a key leaks. We will rotate it, and we will not charge you for the rotation.
• We may rotate or revoke a key without notice if we believe it has been compromised, and we will tell you as soon as we safely can.

5. Rate limits and fair use

We apply rate limits so one integration cannot degrade the service for everyone else. When you exceed one you will receive HTTP 429 with a Retry-After header. Back off and honour it.

Limits are published in the API documentation rather than here, because they change as capacity changes. We will not tighten a limit in a way that breaks a working integration without notice and a migration window.

Do not poll where a webhook exists. Webhooks are the supported way to hear about changes.

6. What you must not do

• Do not use the API to extract the public directory. Teacher profiles, listings and their contact routes are not yours to harvest, republish or resell, whether through the API, the website or any other route. This is the line we care about most.
• Do not use it to access data belonging to an organisation that has not authorised you.
• Do not attempt to bypass rate limits, authentication, or any access control.
• Do not use it to send unsolicited messages to families or teachers, or anything that would breach the Spam Act 2003.
• Do not use it to build a product whose purpose is to compete with the directory by copying its contents.

Breaching this section is grounds for immediate revocation under clause 8.

7. Personal information

Studio data includes personal information, and often children's personal information. If you pull it through the API you become responsible for it.

• Handle it under the Australian Privacy Principles, whether or not the Privacy Act binds you by size.
• Collect only what your integration actually needs.
• Do not use it to train a machine learning model without the explicit written consent of the organisation whose data it is.
• Delete it when the integration ends.

If you are building on behalf of a school, they will usually need a data processing agreement with you. That is between you and them.

8. Suspension

We may suspend or revoke a key immediately where we reasonably believe it is compromised, is being used in breach of section 6, or is causing a risk to the Platform or to other users.

Where the reason is not urgent we will tell you first and give you a chance to fix it. Where it is urgent we will act first and explain straight after. You can appeal to support@teachmusic.com.au and a person will review it.

9. Changes to the API

APIs change. Ours will.

• Additive changes (new endpoints, new optional fields) can happen at any time. Write your integration so an unexpected field does not break it.
• Breaking changes get at least 90 days notice by email to the address on your account, and the old behaviour keeps working for that period wherever it is technically possible.
• If we ever retire the API entirely, you get 180 days and a documented export path, because clause 3 is not conditional on the API existing.

10. No warranty on the API specifically

The Platform warranties in the Terms of Service continue to apply, and nothing here removes your rights under the Australian Consumer Law.

Beyond those, the API is provided as it is. We do not warrant that it will be uninterrupted, that a particular endpoint will keep a particular shape, or that it will suit a purpose you have in mind. Build defensively: handle errors, retry sensibly, and do not assume a response you have not tested for.

11. Contact