My servers never hit these APIs. The calls go straight from the APP.
My users are made to acknowledge the fact that this is happening. The app is free.
I know, I have to get legal advice. Has anyone faced a situation like this?
If the API owner gained knowledge and warned you they could now claim damages in a civil lawsuit. You're an enabler. You're trying to defer the obligation to your users while ignoring the easier approach to disable the feature. It's tricky with open source software since anybody could have a copy and continue, or use an old version. A court (more likely lawyers sending letters to each other) would question if you did everything in your power to stop the API access.
> anyone faced a situation like this?
As API owner multiple times. App is for, let's say, taxi drivers. Each user is expected to create a free account and does some small usage. Taken together it would not be covered by a free account. The app developer charges money and instead of creating a paid account with us tells all users to have free accounts. We don't sue but we have deleted accounts and added IP blocks over this.
From what I've seen one approach is not to ask users to acknowledge, that's a click of a button I assume. It needs to be more actively. Like a field the user has to fill out with a URL, a plugin that needs to be installed separately or a small piece of code that needs to be written (if it's a software library). Then you can claim the user is in control and chose to use that API.
Can I tell them what to fill? Also once they fill it, can I cache it?
Their product has Terms and Conditions. Like no reselling of data etc.