WoWUtils

API Terms

The public API lets a group pull its own Viserio data into the tools it already uses. These terms cover API keys and every request to api.wowutils.com, on top of the Terms of Service.

Last updated

1. Agreeing to these terms

By creating an API key or sending a request to the API you agree to these terms. If you do not agree, do not use the API. The developer guide and reference live on the For Developers page.

2. Keys

  • A key belongs to a group, not a person. A group admin turns on API sharing and creates the group’s one key from the group settings. Turning sharing off stops access within a few minutes.
  • Access is free. A supporter boost raises the group’s request quota; it is not needed to use the API.
  • Regenerating the key revokes the old one. Quotas are counted per group, so a new key does not reset them.
  • The key is a shared group secret. Every admin of the group is responsible for keeping it secret and for what is done with it. Send it only in the Authorization header, never in a URL.
  • When you create the key you say what kind of integration it is and describe honestly what it does, and you keep that description current. You may leave a contact handle so we can reach you about it.

3. What you may build

  • Anything that serves the group the key belongs to: a guild website, a spreadsheet, a Discord bot, or a commercial tool the group chose to connect.
  • A group’s data serves that group. You may not combine data from many groups into a product of your own, or use the API to copy WowUtils’ own data (boss timelines, spell data, the plan Library) into another service. The Terms of Service say more about competing products.
  • Anything that stores or shows the data must follow section 6 and the terms of the services the game data comes from, starting with Blizzard’s.

4. Acceptable use

Use the API in good faith. Not allowed:

  • Getting around rate limits. Holding keys for several real groups you run is fine. Creating fake or duplicate groups, or spreading requests across addresses, to multiply the quota for one integration is not.
  • Repeating requests after a 429 or 503. Ignoring Retry-After leads to a temporary block of your IP address.
  • Probing: guessing or iterating identifiers, requesting groups you do not run, or any other attempt to reach data you are not entitled to.
  • Using battletags, character names or any other data to harass, expose or profile people, or to contact them unasked.
  • Showing a member’s details (for example their battletag) where that member has not agreed to it. The group’s opt-in does not replace your own judgement about its members.
  • Combining data from many groups into a directory, dataset or product of your own, or reselling or republishing a group’s data without that group’s consent.
  • A false or outdated key description, or posting a group’s key publicly. Handing the key to the tool it is meant for is expected; the description should say what that tool is.

Expected: cache sensibly, prefer conditional requests (ETag and If-None-Match) and incremental polling over tight loops, respect Retry-After, pin to /v1 and handle changes and outages gracefully.

5. What the API shares

A group’s own coordination data, and only what a real integration needs: its roster, raid plans, calendar and loot planning, as the API reference lists in full. The personal data in it is limited to display names, battletags and character names. Before anything is added we ask whether a real use needs it and whether it is ours to pass on.

The API never shares the private Battle.net account number we sign people in with, payment or supporter details, access tokens for other services, or internal system data. Supporters who boost a group are never named.

A group admin decides whether the group’s data is shared. A member who does not want their battletag shared can ask a group admin to turn sharing off or remove them from the roster. For each request we log the time, path, key, IP address and response status, never the response itself. The Privacy Policy covers the rest of WowUtils.

6. What you must do with the data

  • Keep personal data (battletags, character names) only as long as your integration needs it.
  • Do not build a permanent copy. Delete cached data within 30 days unless you fetch it again; a cache that refreshes and expires is fine.
  • Delete a group’s data when its access ends or its admin turns sharing off.
  • Follow Blizzard’s Battle.net and World of Warcraft API terms for anything you store or show.
  • Protect stored data at least as carefully as your own passwords.

7. Stability

Version 1 is still settling. Endpoints, response shapes, limits and availability may change, break or be removed, and there is no uptime, support or backward-compatibility promise. Pin to /v1 and build defensively. We announce bigger changes in the developer channel on Discord, but may change things without notice to protect the service. The API mostly reads; its few writes stay inside the group’s own data, and a key can never reach another group.

8. Enforcement

We watch for unusual volume, identifier scanning and high error rates. For any breach we may throttle, suspend or permanently revoke a key and block an IP address, without notice, to protect the service and the people whose data it carries. A group admin can turn off API sharing or revoke the key at any time.

9. Security problems

If you find a vulnerability, report it privately by email or to Penkek on Discord. Do not publish it or use it.

10. Warranty and changes

The API is provided as is and as available, with liability limited as the Terms of Service describe. We may update these terms; the date at the top shows the last change, and using the API after a change means you accept it.