# RapidAPI Hub listing self-check: docs fields, plans, privacy, and the proxy secret


*Not legal advice. Every Hub field and security fact below comes from RapidAPI docs on docs.rapidapi.com, fetched 2026-10-15 (Asia/Shanghai). RapidAPI can change Studio and these pages at any time; re-read them before you make an API public.*

You can price an API carefully and still ship a listing that confuses buyers or leaves your origin open. This is a pre-publish self-check against what RapidAPI's own Hub Listing docs actually describe.

## 1) Lead answer

1. **General tab** is where buyers first judge you: logo, category, short and long description, website, terms of use, visibility, tags, and base URLs ([Hub Listing - General Tab](https://docs.rapidapi.com/docs/hub-listing-general-tab)).
2. **Docs tab README** lands on the listing's About tab; the long description lands under the short description on Endpoints. Both accept markdown ([Hub Listing - Docs Tab](https://docs.rapidapi.com/docs/hub-listing-docs-tab)).
3. **Definitions** hold endpoints, security schemes, and OpenAPI/Postman imports ([Hub Listing - Definitions Tab](https://docs.rapidapi.com/docs/hub-listing-definitions-tab); [Configuring API Security](https://docs.rapidapi.com/docs/configuring-api-security)).
4. **Monetize** supports up to four public plans (BASIC, PRO, ULTRA, MEGA). On rapidapi.com the default free BASIC plan allows one million requests per month unless you change it ([Hub Listing - Monetize Tab](https://docs.rapidapi.com/docs/hub-listing-monetize-tab)).
5. **Gateway**: every Rapid Runtime request carries a unique `X-RapidAPI-Proxy-Secret`. Missing or wrong means the call did not come from Rapid. Copy it from Firewall Settings and enforce it on your origin ([Hub Listing - Gateway Tab](https://docs.rapidapi.com/docs/hub-listing-gateway-tab)).
6. **Privacy / retention as a Hub field:** the General tab has optional Terms of use text; Rapid documents request/response logs "up to 7 days" on the Gateway. A separate mandatory "privacy policy URL" or "data retention days" field for providers is **Not verified** in the pages reviewed.

## 2) General tab checklist

From [Hub Listing - General Tab](https://docs.rapidapi.com/docs/hub-listing-general-tab):

- [ ] **Logo.** Default is a random image. Upload JPEG/PNG, max 500x500. Hosted on Rapid's infrastructure.
- [ ] **Category.** Exactly one. Buyers browse by category (examples in the docs: SMS, Education, Commerce, Video and Images, News).
- [ ] **Short description.** Shown on Hub tiles and search; truncated if too long. Also shown first on the Endpoints tab.
- [ ] **Long description.** Markdown under the short description on Endpoints.
- [ ] **Website (optional).** Shown on About as "Product Website".
- [ ] **Terms of use (optional).** Markup or a link; opens in a popup from About → Resources. You can paste full text or a URL such as a terms page.
- [ ] **Visibility.** New APIs start **private**. Making one public on rapidapi.com requires checking the Terms of Service box; team-owned APIs need an org admin approval.
- [ ] **Tags.** Name-value pairs configured by the environment; shown on tiles and used in search filters.
- [ ] **Base URLs.** Set where the Runtime forwards traffic; confirm they point at your production origin.
- [ ] **Health check.** Present on the General tab; whether it is required before going public is **Not verified**.

## 3) Docs tab vs long description

From [Hub Listing - Docs Tab](https://docs.rapidapi.com/docs/hub-listing-docs-tab):

- **Docs / README** → markdown on the listing **About** tab (visual editor available).
- **Long description** (General) → markdown under the short description on **Endpoints**.

Use either or both. A practical split: About README for auth overview, limits, and failure modes; Endpoints long description for what each resource returns. Images in README use the toolbar or markdown image syntax.

## 4) Definitions and security

From [Hub Listing - Definitions Tab](https://docs.rapidapi.com/docs/hub-listing-definitions-tab) and [Configuring API Security](https://docs.rapidapi.com/docs/configuring-api-security):

- Prefer updating endpoints by **re-uploading OpenAPI or Postman** so you keep one source of truth.
- Path parameters, query params, headers, and body types are defined per endpoint.
- **RapidAPI Auth** headers are always in play on rapidapi.com because every public Hub API uses the Rapid Runtime. Extra schemes (header, query, basic, bearer, OAuth2, etc.) are optional and stack on top.
- If you add your own auth scheme, document what the consumer must send; the scheme description appears next to Authorization in the listing.

Self-check: call each public endpoint from the playground with only the documented headers. If your origin accepts the same call without Rapid headers, you have a Gateway problem (next section).

## 5) Monetize tab (plans only — not payout math)

Payout percentages and settlement lag are covered in [this guide](https://kendeepp.hashnode.dev/rapidapi-provider-payouts-paypal-25-percent). For listing readiness, the Monetize docs say:

- Up to **four public plans**: BASIC, PRO, ULTRA, MEGA, plus private plans ([Hub Listing - Monetize Tab](https://docs.rapidapi.com/docs/hub-listing-monetize-tab)).
- Default **BASIC** is free; on rapidapi.com it allows **one million** requests/month unless changed. Consumers get emails at 85% and 100% of quota.
- Plan knobs: visibility, type, subscription price, objects/quotas, features (endpoint access), optional approval, optional contract, "Recommended" label.
- Changing a plan after subscribers exist leaves them on the old plan labeled "Deprecated Plan".
- From [Monetizing Your API on rapidapi.com](https://docs.rapidapi.com/docs/monetizing-your-api-on-rapidapicom): Free / Pay Per Use / Freemium / Paid; Free APIs cannot collect payments through Rapid; freemium and paid require a credit card even for a free tier; above 500K requests/month the minimum is **$0.00003 per call** (example: 2M/month → at least $45/month).

**Conflict to remember:** Monetizing page cites a 500K free-plan cap; Monetize Tab cites 1M for default BASIC on rapidapi.com. Which cap a brand-new listing gets is **Not verified** until you read your own Studio plan.

Suggested list prices in the monetizing docs (BASIC free / PRO $25 / ULTRA $75 / MEGA $150) are recommendations, not requirements.

## 6) Gateway: Proxy-Secret, secrets, and logs

From [Hub Listing - Gateway Tab](https://docs.rapidapi.com/docs/hub-listing-gateway-tab):

- On rapidapi.com, APIs **must** use the Rapid Runtime.
- Rapid adds **`X-RapidAPI-Proxy-Secret`** to every request. Unique per API. If missing or different, treat the call as not from Rapid.
- Copy the value from **Firewall Settings** and validate it in your API gateway or app.
- Optional: allowlist the published Rapid Runtime IP list (same page).
- **Secret headers & parameters:** name/value pairs Rapid injects and hides from consumers (useful for a single upstream API key). Transformations are the more flexible alternative when values differ by plan or endpoint ([Request and Response Transformations](https://docs.rapidapi.com/docs/hub-listing-request-and-response-transformations)).
- Runtime benefits listed include timeout/rate/size/quota enforcement, monetization, analytics, mocking, transformations, **detailed request and response logs (up to 7 days)**, and automatic CORS for playground tests.

Self-check: from a non-Rapid client, call your origin URL directly. The request must fail your Proxy-Secret (and/or IP) check. Then call via the Hub playground and confirm success.

## 7) Privacy and data retention — what the Hub docs say vs what they do not

**Documented:**

- Optional **Terms of use** field on General (can hold privacy text or a link) ([General Tab](https://docs.rapidapi.com/docs/hub-listing-general-tab)).
- Rapid Runtime keeps **detailed request/response logs up to 7 days** ([Gateway Tab](https://docs.rapidapi.com/docs/hub-listing-gateway-tab)).

**Not verified** from the Hub Listing pages reviewed:

- A dedicated mandatory privacy-policy URL field.
- A Hub-enforced retention period for **your** storage of uploaded files (for example PDF bodies you write to disk).
- Whether Rapid's 7-day logs include full payloads for all content types, who can access them, and how deletion requests work.

If your API accepts uploads or personal data, say in Terms of use / README what you store, for how long, and what you delete — and make the implementation match. Do not invent a RapidAPI retention SLA that the docs do not state.

## 8) One-page pre-publish checklist

- [ ] Logo, category, short description, long description, README filled.
- [ ] Terms of use states refunds, abuse, and (if relevant) data handling.
- [ ] Visibility set to public only after playground tests pass.
- [ ] OpenAPI matches live endpoints; security schemes match what buyers must send.
- [ ] Plans: free BASIC limits honest; paid floors respect $0.00003 above 500K if applicable.
- [ ] `X-RapidAPI-Proxy-Secret` enforced on origin; direct hits rejected.
- [ ] Secret upstream keys live in Gateway secrets or transformations, not in consumer-visible docs.
- [ ] PayPal linked and fee model understood via [this guide](https://kendeepp.hashnode.dev/rapidapi-provider-payouts-paypal-25-percent) before turning paid plans on.

## 9) Sources

- Hub Listing - General Tab: https://docs.rapidapi.com/docs/hub-listing-general-tab
- Hub Listing - Docs Tab: https://docs.rapidapi.com/docs/hub-listing-docs-tab
- Hub Listing - Definitions Tab: https://docs.rapidapi.com/docs/hub-listing-definitions-tab
- Configuring API Security: https://docs.rapidapi.com/docs/configuring-api-security
- Hub Listing - Monetize Tab: https://docs.rapidapi.com/docs/hub-listing-monetize-tab
- Monetizing Your API on rapidapi.com: https://docs.rapidapi.com/docs/monetizing-your-api-on-rapidapicom
- Hub Listing - Gateway Tab: https://docs.rapidapi.com/docs/hub-listing-gateway-tab
- Hub Listing - Request and Response Transformations: https://docs.rapidapi.com/docs/hub-listing-request-and-response-transformations

Product links: None (no product links).