# DigiZay automated access policy

Public search indexing, short attributed answers about public products and guides,
model training on public content, and customer-directed shopping through the
official interfaces are permitted.
Use the current product quote as the source of truth for prices and availability.

Abusive scraping that overloads the service, collection of private data, security
probing without written permission, credential or transaction-ID guessing,
access to another customer's data, bypassing access controls or rate limits,
and creating speculative quotes, payment QR codes or orders are not permitted.
Public visibility does not grant permission for these activities.

Use https://digizay.com/api/shop/mcp for customer shopping, not browser scraping.
Guests need no key. Optional account access uses Authorization: Bearer dzm_...
with an MCP key from https://digizay.com/dashboard/api configured by the agent
host. It links orders to the account, cannot spend wallet balance, can be revoked
and expires in 365 days. Legacy dz_ reseller Bearer keys remain accepted for
compatibility but are not recommended; they can spend wallet funds via the
reseller REST API. Never ask users to share passwords, PINs, OTPs or private keys
in chat. Show the product/variant, quantity, phone and exact total in MMK; obtain
explicit confirmation before create_order with the same quoteId and confirmed:true.
Payment is MMQR only: show the QR image and ask the customer to pay once. Submit
payment confirmation only after they say they paid; DigiZay verifies payment.
Preserve the same quote through retries and respect HTTP Retry-After.
Do not retry rejected requests with alternate identities or network addresses.

Reseller integrations use /api/v1 with their own X-Api-Key: dz_... header
(Authorization: Bearer dz_... is also accepted). See https://digizay.com/docs.
Customer tools grant no administrative authority. Contact DigiZay through https://digizay.com/contact
to request permission or report a vulnerability without exploiting it.

These permissions do not override authentication, ownership checks or technical
limits. A user-agent name, this policy or an llms.txt file is not an access key.