The AGPL gives you the right to obtain the server-side code and to provide a competing service based on that code, but it does not say anything about the Terms-of-Service that apply.

@BartvanIngenSchenau yes, exactly. Do I miss to make that clear?

It was less than 100% clear to me that you meant it that way. Hence my comment.

Ok, thanks. I added your very concise summary to this answer :)

I appreciate your professional response! I now understand that without the owner’s permission or terms of service, I cannot use the API, and that an open-source license does not imply I have the right to use the API.

However, I have a small question. If such an API is owned and implemented by the open-source provider themselves, in this case, as someone who wishes to contribute to the project, am I not allowed to use this API (without any form of terms of service or stated usage rules) for the purpose of debugging, modifying, and contributing to the project? According to your answer, it seems that I cannot, and your explanation is very clear. But my point is that, in my view:

1. If the server-side code of the API is closed-source (which is the case in most instances I’ve mentioned), others will be unable or will find it very difficult to contribute to such an open-source project. 2. As both the open-source provider and the owner of the API, if they do not wish others to use this API, shouldn’t they omit or hide this API in their open-source code? Although this is obviously not their responsibility, I think this would be the normal practice. Thank you!

@Miller usually you will have a server with the API running for test services (or conditions under which you can run tests on the API) if custom clients to interact with it are expected. There is no need to hide the API, and in an open source software you cannot hide the client-side version of the API (because then it wouldn't be open source - though you might do that if you'd go for a permissive license... but that would put the whole open source client into the domain of questionable utility for anyone)

Wait, but this assumes that I start by inspecting the client's code or behaviour. Imagine: I found such a repo with client code on github licensed under, say, MIT, and neither license nor readme mention that external API. I clone the repo, make build and use the product. I did not read the source code and do not know about an external API call. At this point I did not have to accept ToS of that API, and don't even know that they exist.

(that's not the case for GitHub API since that requires auth, and credentials can only be generated by GItHub users who accepted their ToS explicitly during sign-up)

@SUTerliakov Ignorance is not an excuse for liability.

It isn't ignorance: the license does not imply that I have to investigate how the program works. I read the license claiming that "permission is hereby granted [...] to deal in the Software without restriction, including without limitation the rights to use [...]". And that's what I do: I obtain a copy and start using the software. (to make this even more obvious, let's say I'm not a developer and have no idea what curl -fsSL my.private.api.com means in the middle of that bash script) If the API isn't mentioned in the license/readme, how should I know it's in use?

@SUTerliakov on the same line I have every right to use a knife how I want (and within the legal limits). It still doesn't allow me to cut a slice from the steak of my neighbour without their consent.

You don't have a reason to assume that a steak belongs to you (or you have a right to use it), and you certainly know that a steak exists... I don't think "I knowingly use someone else's property" and "I use a tool I have permission to use, and that tool uses someone else's property without advertising that" are related.

Something else about the AGPL: by merely calling a service the source of which is AGPL licensed you now need to license your own code under AGPL as well. User beware!

@SUTerliakov: I think the legal position here is that if you're told you have a license to run the program, and you run the program, but in its default settings it connects to some server belonging to the software author that you haven't been given permission to access, then you likely have a pretty good defence against being accused of making unauthorised access. But it doesn't follow you have permission, and if you're informed that you don't have permission then you start losing that defence. Unwittingly trespassing isn't the same thing as being permitted to be there.

So for example, a piece of software that I use (Conda) switched to a model where the software remains free, but corporate users (me at work) have to pay for access to the server it by default connects to. This information was extremely well communicated, and in no way could we claim not to be aware of it, so I changed the config at work not to access that server. I continue to use it in default config at home. A company that had no idea what was going on and accidentally used in the wrong configuration would not be prosecuted, but Conda can cease-and-desist them. Then they know.

In other cases it might be obvious that "permission ... to deal without restriction" does not include the right to access the authors' servers. So, if I write free pen testing software, it doesn't give you permission to pen test my sites. Of course you'd have to copy-paste my URL into the software: it's not the default setting. But my point is, permission to run it doesn't necessarily imply permission to actually do whatever it is the software does on your behalf. It's a copyright license, not permission to do whatever you like to the author provided you do it by running their software!

The readme and license are not relevant for whether you may access the servers that the software uses. One mechanism for access control is a contract. In the absence of a contract, the server owner may use technical means (rate limiting, authentication, etc), and circumventing that could count as hacking by some legal definitions. In the absence of a contract or technical restrictions, there is no limitation on your use of a public server. So I think the impression of a legal landmine for using free software is wrong. But if you're not satisfied by that, Law.SE is available.