OpenTerms Specification

GET https://openterms.com/api/v1/check?domain=github.com&action=read_content

{
  "success": true,
  "domain": "github.com",
  "action": "read_content",
  "result": { "value": null, "confidence": null, "caveats": [] },
  "permission": "not_specified",
  "confidence": 0,
  "error": "no_openterms_json",
  "message": "No openterms.json found at github.com."
}

GET https://openterms.com/api/v1/check?domain=example.com&action=read_content

{
  "success": true,
  "domain": "example.com",
  "action": "read_content",
  "result": {
    "value": true,
    "confidence": "high",
    "caveats": []
  },
  "permission": "allowed",
  "confidence": 0.99,
  "policy_excerpt": "Explicitly allowed.",
  "checked_at": "2026-05-02T21:00:00.000Z"
}

Before performing any action on a third-party domain, check OpenTerms to verify 
that the action is permitted by that domain's terms of service.

Check endpoint:
  GET https://openterms.com/api/v1/check?domain={domain}&action={action}

Canonical actions to check:
  read_content     — read publicly available content
  scrape_data      — bulk-download or scrape data from the domain
  api_access       — access the domain's API programmatically
  create_account   — create a user account on the domain
  make_purchases   — make purchases or financial transactions
  post_content     — post, publish, or submit content
  allow_training   — use the domain's published content for model training

Decision policy:
  result.value = true             → allowed. Proceed. Log the check.
  result.value = false            → denied. Block. Do not proceed.
  result.value = null             → not specified. Fail closed. Treat as denied.
  result.value = {object}         → conditional. Read the conditions field.
                                    Only proceed if allowed=true and conditions are met.
  result.confidence = "low"       → escalate to human regardless of value.

Logging (required for every check):
  Log: domain, action, decision, confidence, checked_at, agent_id

Human escalation (required when):
  - result.value is null for high-stakes actions (purchases, account creation, post_content)
  - result.confidence is "low"
  - result is a conditional object and conditions cannot be verified programmatically
  - The domain is unvalidated

OpenTerms is one input to your decision — it does not replace legal review for 
regulated use cases. When in doubt, escalate.

import requests

# 1. Check
resp = requests.get(
    "https://openterms.com/api/v1/check",
    params={"domain": "acme.com", "action": "scrape_data"}
)
check = resp.json()

# 2. Interpret
value = check["result"]["value"]
confidence = check["result"]["confidence"]

# 3. Decide
if value is True and confidence != "low":
    # Proceed
    log_check("acme.com", "scrape_data", "allowed")
    scrape_pricing_page("https://acme.com/pricing")
elif value is False:
    # Block
    log_check("acme.com", "scrape_data", "denied")
    raise PermissionDenied("scrape_data denied on acme.com")
else:
    # null or low confidence → escalate
    escalate_to_human("acme.com", "scrape_data", check)

$ curl "https://openterms.com/api/v1/check?domain=stripe.com&action=api_access"

# result.value = true, confidence = 0.75 → "low" tier
# Decision: escalate (api_access has <80% accuracy — human review recommended)

check = openterms_check("example.com", "create_account")

if check["result"]["value"] is None:
    # null = not specified — fail closed for account creation
    escalate_to_human("create_account on example.com: not specified in openterms.json")
elif check["result"]["value"] is True:
    create_account("example.com")
else:
    raise PermissionDenied("create_account denied")

check = openterms_check("forum.example.com", "post_content")
result = check["result"]

if isinstance(result["value"], dict):
    # Conditional — check the conditions
    if result["value"]["allowed"]:
        print(result["value"]["conditions"])  # e.g. "Must disclose AI authorship"
        escalate_for_human_confirmation()
    else:
        raise PermissionDenied("post_content denied under conditions")
elif result["value"] is True:
    post_content("forum.example.com", content)
else:
    raise PermissionDenied()

check = openterms_check("dataset.example.com", "allow_training")
result = check["result"]

# allow_training has ~50% accuracy — always escalate regardless of value
if result["confidence"] == "low":
    escalate_to_human(
        "allow_training has low confidence accuracy — human review required"
    )
elif result["value"] is True:
    add_to_training_dataset("dataset.example.com")
elif result["value"] is False:
    raise PermissionDenied("allow_training denied")
else:
    # null — fail closed for training data
    raise PermissionDenied("allow_training not specified — fail closed")

{
  "$schema": "https://openterms.com/schema/openterms.schema.json",
  "openterms_version": "0.3.0",
  "service": {
    "name": "Your Service",
    "domain": "yourservice.com",
    "tos_url": "https://yourservice.com/terms"
  },
  "permissions": {
    "read_content": true,
    "scrape_data": false,
    "api_access": true,
    "create_account": false,
    "make_purchases": false,
    "post_content": false,
    "allow_training": null
  },
  "requires_consent": true,
  "jurisdiction": "US",
  "contact": "legal@yourservice.com",
  "last_updated": "2025-06-01"
}

{
  "make_purchases": {
    "allowed": true,
    "conditions": "Max $500/day. Agent must be linked to verified human.",
    "requires_auth": true,
    "max_frequency": "50/day",
    "scope": "authenticated"
  }
}

{
  "rate_limits": {
    "requests_per_minute": 60,
    "requests_per_hour": 1000,
    "requests_per_day": 10000,
    "concurrent_sessions": 5
  }
}

{
  "data_handling": {
    "stores_agent_data": true,
    "shares_with_third_parties": false,
    "retention_days": 90,
    "gdpr_compliant": true,
    "ccpa_compliant": true,
    "hipaa_compliant": false,
    "data_residency": ["US", "EU"]
  }
}

{
  "authentication": {
    "required": true,
    "methods": ["api_key", "oauth2"],
    "registration_url": "https://acme.com/developers",
    "docs_url": "https://docs.acme.com/auth"
  }
}

{
  "verification": {
    "jwks_url": "https://acme.com/.well-known/jwks.json",
    "signing_algorithm": "Ed25519",
    "policy_hash": "a1b2c3d4e5f6..."
  }
}

{
  "extensions": {
    "health.hipaa.baa_required": true,
    "health.hipaa.audit_log_url": "https://acme.com/api/audit",
    "com.acme.internal_tier": "enterprise",
    "org.fintech.pci_dss_level": 1
  }
}

{
  "extensions": {
    "com.openterms.meta": {
      "source": "self",
      "generator": "openterms.com/v0.3.0"
    }
  }
}

{
  "$schema": "https://openterms.com/schema/openterms.schema.json",
  "openterms_version": "0.3.0",
  "service": "acme-corp.com",
  "permissions": {
    "read_content": true,
    "scrape_data": false,
    "api_access": {
      "allowed": true,
      "requires_auth": true,
      "max_frequency": "1000/hour"
    }
  },
  "discovery": {
    "mcp_servers": [
      {
        "url": "https://acme-corp.com/mcp/sse",
        "transport": "sse",
        "description": "Provides tools for checking order status and inventory."
      }
    ],
    "api_specs": [
      {
        "url": "https://api.acme-corp.com/v1/openapi.json",
        "type": "openapi_3",
        "description": "Full REST API for catalog and user management."
      }
    ]
  }
}

# AI Agent Terms
OpenTerms: https://yourdomain.com/openterms.json

curl -X POST https://openterms.com/api/validate \
  -H "Content-Type: application/json" \
  -d '{"content": <your openterms.json>}'

$ curl -s "https://openterms.com/api/v1/check?domain=example.com&action=scrape_data"
{
  "success": true,
  "domain": "example.com",
  "action": "scrape_data",
  "result": "no_openterms_json",
  "checked_at": "2026-05-08T14:00:00.000Z"
}

import requests

def check_action(domain: str, action: str) -> str:
    """Returns 'allowed', 'denied', or 'no_openterms_json'."""
    resp = requests.get(
        "https://openterms.com/api/v1/check",
        params={"domain": domain, "action": action},
        timeout=10,
    )
    resp.raise_for_status()
    data = resp.json()
    return data.get("result", "no_openterms_json")

# Usage — works whether or not the domain has published openterms.json
status = check_action("example.com", "scrape_data")
if status == "denied":
    print("Action not permitted by site policy.")
elif status == "no_openterms_json":
    print("No openterms.json found — apply your default policy.")
else:
    print("Permitted.")

// Returns 'allowed', 'denied', or 'no_openterms_json'
async function checkAction(domain, action) {
  const url = `https://openterms.com/api/v1/check?domain=${domain}&action=${action}`;
  const res = await fetch(url);
  if (!res.ok) throw new Error(`OpenTerms check failed: ${res.status}`);
  const data = await res.json();
  return data.result ?? 'no_openterms_json';
}

// Usage
const status = await checkAction('example.com', 'scrape_data');
if (status === 'denied') {
  console.log('Action not permitted by site policy.');
} else if (status === 'no_openterms_json') {
  console.log('No openterms.json found — apply your default policy.');
}

import requests

# Framework-agnostic guard — call this before executing any agent action
def openterms_guard(domain: str, action: str) -> dict:
    resp = requests.get(
        "https://openterms.com/api/v1/check",
        params={"domain": domain, "action": action},
        timeout=10,
    ).json()

    result = resp.get("result", "no_openterms_json")
    # During public alpha, no_openterms_json is normal — domain hasn't published yet
    return {
        "permitted": result == "allowed",
        "result": result,
        "domain": domain,
        "action": action,
    }

# Wire into your framework — example shows a generic tool-call pattern
# See the README for current usage examples with specific frameworks.

$ pip install crewai-openterms

from crewai import Agent, Task, Crew
from crewai_openterms import OpenTermsCheckTool

# Instantiate the permission-check tool
check_tool = OpenTermsCheckTool()

# Wire it into a CrewAI agent as a pre-action guard
agent = Agent(
    role="Web Research Agent",
    goal="Check site permissions before scraping",
    backstory="Respects publisher terms before acting.",
    tools=[check_tool],
    verbose=True,
)

task = Task(
    description="Check whether scrape_data is permitted for example.com",
    expected_output="Permission result from OpenTerms API",
    agent=agent,
)

# The tool calls GET https://openterms.com/api/v1/check internally
crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff(
    inputs={"domain": "example.com", "action": "scrape_data"}
)

$ pip install langchain-openterms

# With openterms-py SDK (recommended — requires openterms-py>=0.3.1):
$ pip install "langchain-openterms[sdk]"

from langchain_openterms import OpenTermsGuard

# Wrap any LangChain tool — fail-closed by default
# from langchain_community.tools import BraveSearch
# search = BraveSearch.from_api_key(api_key="...", search_kwargs={"count": 3})
guarded_search = OpenTermsGuard(
    tool=search,
    action="read_content",
)

result = guarded_search.invoke("https://example.com/pricing")
if "blocked" in result.lower():
    print("Cannot proceed:", result)
else:
    print("Allowed:", result)

GET https://openterms.com/api/v1/check?domain=example.com&action=scrape_data

{
  "success": true,
  "domain": "example.com",
  "action": "scrape_data",
  "result": {
    "value": false,
    "confidence": "medium",
    "caveats": []
  },
  "permission": "denied",
  "confidence": 0.99,
  "policy_excerpt": "Explicitly denied.",
  "openterms_version": "0.3.0",
  "checked_at": "2026-04-24T09:00:00.000Z"
}

$ curl "https://openterms.com/api/v1/check?domain=github.com&action=scrape_data"

import requests

def check_permission(domain: str, action: str):
    resp = requests.get(
        "https://openterms.com/api/v1/check",
        params={"domain": domain, "action": action},
        timeout=30
    )
    data = resp.json()
    result = data.get("result", {})

    # Always check for caveats warnings
    for caveat in result.get("caveats", []):
        print(f"⚠️  {data['action']} on {data['domain']}: {caveat}")

    # Log low-confidence fields for human review
    if result.get("confidence") == "low":
        print("❗ Manual verification recommended.")

    return result.get("value")  # True / False / None

# Usage
decision = check_permission("example.com", "allow_training")

openterms-registry-seed/
├── validated/
│   ├── github-com.json
│   ├── stripe-com.json
│   └── ... (all validated entries)
├── unvalidated/
│   ├── example-com.json
│   └── ... (all unvalidated entries)
├── flagged/
│   └── ... (entries with data quality issues)
├── index.json     ← manifest: domain, category, validation_status, confidence
└── README.md      ← schema version, generated timestamp, usage

{
  "generated_at": "2026-04-16T14:00:00.000Z",
  "schema_version": "0.3.1",
  "total": 511,
  "counts": { "validated": 53, "unvalidated": 458, "flagged": 0 },
  "entries": [
    {
      "domain": "github.com",
      "filename": "github-com.json",
      "category": "Developer Tools",
      "validation_status": "validated",
      "confidence": 0.9
    }
  ]
}

import requests
import json
from datetime import datetime, timezone

def check_and_log(domain: str, action: str) -> str:
    """Check permission and log the result. Returns result string."""
    resp = requests.get(
        "https://openterms.com/api/v1/check",
        params={"domain": domain, "action": action},
        timeout=10,
    )
    resp.raise_for_status()
    data = resp.json()
    result = data.get("result", "no_openterms_json")

    # Build an internal log record
    record = {
        "domain": domain,
        "action": action,
        "result": result,
        "checked_at": datetime.now(timezone.utc).isoformat(),
    }
    with open("permission_checks.jsonl", "a") as f:
        f.write(json.dumps(record) + "\n")
    return result

# Usage
result = check_and_log("example.com", "api_access")
if result == "denied":
    print("Action not permitted by site policy.")
elif result == "no_openterms_json":
    print("No openterms.json found — apply your default policy.")

- name: Validate openterms.json
  run: |
    RESULT=$(curl -s -X POST https://openterms.com/api/validate \
      -H "Content-Type: application/json" \
      -d "{\"content\": $(cat openterms.json)}")
    echo "$RESULT" | jq .
    VALID=$(echo "$RESULT" | jq -r '.valid')
    if [ "$VALID" != "true" ]; then
      echo "openterms.json validation failed!"
      exit 1
    fi

// package.json
{
  "scripts": {
    "validate:terms": "curl -sf -X POST https://openterms.com/api/validate -H 'Content-Type: application/json' -d '{\"content\":'$(cat openterms.json)'}' | jq -e '.valid'"
  }
}