Scope & Access
Define permitted API endpoints, allowed request types, allowed downstream uses, and any restricted data categories to limit scope clearly and avoid unauthorized processing.
A clear addendum reduces disputes by documenting permitted API uses, authentication methods, security controls, and remediation steps. It aligns legal, security, and engineering teams on access limits, data use, and incident response responsibilities while preserving the main agreement’s broader commercial terms.
Multiple internal teams commonly collaborate to prepare the addendum: legal drafts compliance language, security defines controls, and engineering specifies technical constraints.
External stakeholders such as vendors, partners, or customers will review access rights, billing terms, and termination mechanics before execution.
Define permitted API endpoints, allowed request types, allowed downstream uses, and any restricted data categories to limit scope clearly and avoid unauthorized processing.
Specify API key types, token lifetimes, rotation schedules, supported auth protocols (OAuth2, API keys), and multi-factor requirements for administrative operations.
State per-tenant and per-key request quotas, burst allowances, throttling behavior, and consequences for sustained overuse or automated abusive patterns.
Address data classification, permitted processing, retention windows, deletion obligations, and obligations to comply with privacy regulations and customer data instructions.
List uptime commitments, maintenance windows, incident severity definitions, target response times, and escalation contacts for outages and security incidents.
Describe termination triggers, grace periods, data export or deletion procedures, remedies for breach, and post-termination access to logs or records.
| Field | Configuration |
|---|---|
| API Key Type | Static key | OAuth2 client credentials |
| Auth Method | Bearer token | OAuth2 refresh support |
| Callback URL | Confirmed pre-production and production URLs |
| Rate Limit | Requests per minute and burst policy |
Ensure your eSignature platform supports required formats and authentication for the addendum and its supporting exhibits.
Choose an eSignature workflow that preserves audit trails, stores completion certificates, and exports signed documents in standard archival formats.
Specify MM/DD/YYYY as the start date
Allow 10–30 days for legal and technical review
Define target days to provision keys and access
Schedule rotation every 90 days or as agreed
Standard 30-day prior written notice
Legal and security finalize addendum language.
Authorized signatories execute the document.
Issue API credentials and configure access controls.
Begin production monitoring and SLA tracking.
Optica standardized API access to reduce back-and-forth with partners and ensure consistent onboarding.
The organization required strict controls for patient data transmitted via API and attached a DPA to the addendum.
Typically a CEO, President, or other corporate officer with delegated contract authority signs on behalf of the company; attach a board resolution when authority is not explicit in corporate records.
General counsel or a named delegate may sign if expressly authorized; internal delegation should be documented and referenced in the signature block.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Varies | Varies | Varies | Varies |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies | Varies | Varies |