46elks Voice API vs Bandwidth Voice API + MCP

46elks Voice API 12

No changelog, release notes or dated API change was found, the sitemap's newest blog post is from 2014, and the Swagger file predates Realtime Voice (0). No dated changes in the 90 days from 8 August (0). Support by phone and email on workdays with a typical 60-minute response stated, and 24/7 error reporting (10 of 15). No official SDK (0). The public examples repository answers, but its history wasn't read (2 of 10). 0+0+10+0+2 = 12.

Bandwidth Voice API + MCP 78

Dated release notes, the newest voice entry on 16 October 2026 (Salesforce Contact Center BYOC voice in EMEA), and node-sdk v8.3.1 and python-sdk v23.3.1 on 13 October 2026 (30). Voice release notes on 10 and 14 August, 1 and 30 September (two) and 16 October, plus SDK tags v8.1.5, v8.2.0, v8.3.0 and v8.3.1 in the window (20). Closed service with release notes and account management. The MCP repository's last commit is still 21 July 2026, v0.3.0 its newest tag (8 of 15). Official SDKs in six languages, current (15). SDKs are generated from the spec, CI not checked (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.

46elks Voice API 40

HTTP Basic credentials per account, with separate credentials per subaccount and no scopes found (18 of 30). Subaccounts separate traffic, with no read-only credential or confirmation for paid actions (6 of 20). Callers' speech, DTMF and SMS replies reach the agent as untrusted input. The docs show how to verify callback origin, with no prompt-injection guidance (5 of 15). Call, SMS and recording history through the API for 90 days (8 of 15). A registered Swedish telecom operator, but no security.txt (404), disclosure policy, bug bounty or certification was found (3 of 20). 18+6+5+8+3 = 40.

Bandwidth Voice API + MCP 70

OAuth 2.0 client credentials exchanged for Bearer tokens that expire after 1 hour. Each credential has roles that set its permissions and a basic or admin account scope, client secrets rotate with up to two active at once, and credentials can be deactivated or deleted, per the 1 October check (30). Roles and basic scope limit what an agent's credential can reach, though we found no read-only voice role and no confirmation step before dialling (10 of 20). Calls carry untrusted caller speech. We found no callback signing or prompt-injection guidance (0 of 15). Voice Insights shows debug logs per call, including API request history and webhook delivery attempts, since 10 August 2026 (15). The security page, read on 2 November, lists ISO 42001:2023, ISO 27001:2022 and SOC 2 Type II, says Bandwidth runs a public bug bounty, and links a vulnerability reporting page with scope and rules. No reward terms were found on that page, no security.txt (404 on 2 November) and no advisories for bandwidth-sdk in OSV. Read as the Bandwidth messaging listing and modal-sandboxes (SOC 2, a bounty and a reporting route, no security.txt) (15 of 20). 30 + 10 + 0 + 15 + 15 = 70.

46elks Voice API 47

Graded on the hosted REST and Realtime Voice APIs with the hosted lines. A status page exists, linked from 46elks.com/status on UptimeRobot (20). It draws its data by script from a path its robots.txt disallows, so no history was readable (5). SMS sending speed is documented in the FAQ, but no limit for calls, numbers or WebSocket sessions was found (5 of 15). llms.txt says to retry 5xx with exponential backoff and not to retry 4xx unchanged, with no Retry-After or idempotency for POST /calls (7 of 15). The SLA page commits to support hours and 24/7 error reporting with no uptime figure, and extended SLAs are by sales (0). Voice and Realtime Voice carry no beta label (10). 20+5+5+7+0+10 = 47.

Bandwidth Voice API + MCP 73

Statuspage at status.bandwidth.com with datacentre, market and calling components (20). Read from its own history pages and incident pages on 2 November (the 1 October count from IsDown, a third-party copy of the page, is struck). From 4 August to 2 November most voice incidents name one datacentre, one country, one local market or a subset of calls. They include LAX outbound calls through that datacentre (10 to 12 August), a subset of JFK voice traffic (14 August), a subset of inbound calls from the Lumen network (7 October), a subset of US toll-free outbound calls (15 to 20 October), France, Japan and single rate centres. Partial incidents read as minor. On 1 September, from 12:15 to 13:29 EDT (74 minutes), outbound calls received an unexpected 404 and failed to connect. The incident page names one affected component, Outbound Calling (SIP) - United States, with inbound and non-US calling unaffected, so it is one direction in one country and read as partial, as hubspot-mcp's regional incident ("many customers in North America") and the toll-free incident here (bland-ai's 14 October outage, which hit every call inbound and outbound, is the major comparison). The 22 October US Voice Traffic major says some customers saw reduced inbound traffic for a carrier's off-network condition, so partial. Minor incidents only (20). Defaults published, 5 calls a second and 100 active sessions, with an outbound queue of 5 minutes of CPS (1,500 calls at 5 CPS), re-read on 2 November (15). 429 is documented with two distinct messages for rate and concurrency, with no Retry-After or backoff guidance (8 of 15). No SLA found (0). The Voice API is generally available. The MCP server is beta (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

46elks Voice API 66

A Swagger 2.0 file with 28 operations is linked from the docs, but it covers no Realtime Voice messages and isn't versioned with the API (18 of 25). An llms.txt written for agents, with a task-to-endpoint table and webhook payloads, while docs pages are HTML (10). Each docs page explains parameters and when webhooks fire, such as voice_start loading only once a call connects (14 of 20). Form-encoded parameters with types in the Swagger file and few enums (9 of 15). Examples in many languages and a JSON error shape, with no error list (10 of 15). The /a1/ path, with no changelog found (5 of 15). 18+10+14+9+10+5 = 66.

Bandwidth Voice API + MCP 88

OpenAPI 3.0.3 spec for the Voice API at dev.bandwidth.com/spec/voice.yml (version 4.1.0, 28 operations, re-read on 2 November) (25). llms.txt that links Markdown versions of the docs pages, re-read on 2 November (10). BXML verb pages explain what each verb does and how callbacks follow, with less on when not to use one (14 of 20). Typed request bodies from the spec (13 of 15). A dedicated Programmable Voice errors page and request examples (14 of 15). Versioned /api/v2 path and dated release notes, though the release notes aren't linked from llms.txt (12 of 15). Total 88.

46elks Voice API 20

No x402, MPP or L402 (0). Per-minute prices by destination are public without login, also in kronor, with incoming calls free (20). No free credit; only SMS to the test number +46700000000 costs nothing, and accounts are prepaid or invoiced against a deposit (0). A person signs up in a browser and copies the credentials (0). 0+20+0+0 = 20.

Bandwidth Voice API + MCP 35

No x402, MPP or L402 (0). US per-minute voice, text-to-speech, recording, transcription and streaming prices are public, re-read on 2 November, but number rental and SIP trunking are quoted by sales (15 of 20). Build trial with 3,000 credits, a US number and no card, re-read on 2 November (20). A trial can be started with band account register, but a person verifies the phone number and creates API credentials, as the Bandwidth messaging listing reads it (0). 0 + 15 + 20 + 0 = 35.

46elks Voice API 51

Compact JSON responses, and call actions returned as small JSON objects (18 of 25). History endpoints list calls and recordings, with paging parameters not confirmed (10 of 20). Errors carry error and detail (12 of 20). No idempotency key on POST /calls or number allocation (3 of 20). Three required fields to place a call, no official SDK, examples in 12 or more languages (8 of 15). 18+10+12+3+8 = 51.

Bandwidth Voice API + MCP 65

Call and recording lists take page sizes. No field selection (15 of 25). Filtering on call lists exists but we didn't confirm the full set this run (15 of 20). Errors page with codes and messages, and 429 bodies say which limit was hit (15 of 20). No idempotency key on call creation. Excess calls queue rather than fail, which makes a retry less often needed (5 of 20). Official SDKs in Node, Python and four more languages. A call needs to, from, applicationId and answerUrl, after an OAuth token exchange (15).