# Hack Club NDA

> Sign a Hack Club nondisclosure agreement or check a member's signing status.

Signing requires Hack Club Auth and a personal details, video pledge, and agreement flow. Agents should use the public status API for lookups.

## Public API

- [API documentation](https://nda.hackclub.com/api/v1/docs): Request examples, response fields, and rate limits. No authentication required.
- [OpenAPI specification](https://nda.hackclub.com/openapi.json): Machine-readable API contract.
- [Source code](https://github.com/hackclub/nda): Application and development documentation.

GET https://nda.hackclub.com/api/v1/nda_status/{info}, replacing {info} with a Slack ID or URL-encoded email address. Unknown identifiers return status "not_signed"; malformed identifiers return HTTP 400. Signed responses include nda_version, signed_at, and signature_type ("native" or "legacy"). Both signature types are valid; do not deny access solely because a signature is legacy. A not_signed response also includes nda_version. Slack lookups include slack_id; email lookups omit it.

## Request pacing

Each client IP shares a limit of 10 requests per one-second window across the site. API responses include RateLimit-Policy and RateLimit (IETF draft), plus numeric RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset headers. Remaining is the budget after this request; reset is seconds until the window resets, not a Unix timestamp. When remaining reaches zero, wait for reset. On HTTP 429, wait at least Retry-After seconds before retrying. Responses use Cache-Control: private, no-store so quota headers stay current. Avoid bulk enumeration of members.