Abyssale vs APITemplate.io

Abyssale 98

A 424 KB OpenAPI file at developers.abyssale.com/api.yaml with 34 operations, from which the reference pages are generated (25). A detailed llms.txt that states the base URL, auth, rate limits, error envelope and webhook signing up front (10). Pages say what each endpoint is for and when to use another, such as synchronous versus asynchronous generation and designs versus workspace templates, and the MCP permissions page says what each tool can break (19 of 20). Typed parameters with enums, ranges and required fields across layers and formats (14 of 15). One error envelope everywhere, an error catalogue with machine-readable ids and what to do for each, and worked examples (15). Date-based versions named in every response and a dated changelog in Keep a Changelog form with a Breaking section first; the MCP server has its own semver changelog (15). 25 + 10 + 19 + 14 + 15 + 15 = 98.

APITemplate.io 5

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. The REST guide links an OpenAPI 3.0.0 description for Postman or code generators, but every reading of the file is struck and none can be taken today (0). No llms.txt (404) and no Markdown docs for agents (0). The operation and parameter descriptions, types, enums, request samples and error schema were read from the file (0, 0 and 0). A /v2 path in the guides, with no changelog (5). 0+0+0+0+0+5 = 5.

Abyssale 85

API version v2026-10-29, eight days before this check (30). Fifteen dated API versions between 21 August and 29 October, MCP server releases 1.0.0 (1 September) to 1.2.0 (7 October), and SDK releases in October (20). Closed service with a changelog and RSS feed, help@abyssale.com and in-app chat, which we didn't test (12 of 15). com.abyssale/mcp is in the official MCP registry under a domain-verified namespace, and the Node.js (1.9.0) and Python (1.7.0) SDKs were both released on 21 October 2026 (15). Both SDKs are current; their repositories weren't read (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

APITemplate.io 11

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. Per the 9 October check. No changelog or release notes exist, and the file's Last-Modified header was metadata, not a dated release (0). No dated changelog entries in the last 90 days (0). Support by email with a stated reply within 24 hours and response times in the SLA, with no public changelog (6). Five SDK repositories, each a generated client committed on 17 September 2023; the Python and JavaScript clones on 5 November show no later commit (3). No tags, CI results or licence files in those repositories (2). 0+0+6+3+2 = 11.

Abyssale 85

20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an id to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.

APITemplate.io 24

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. Per the 9 October check except where struck. export_type=file returns bytes rather than a stored file and expiration sets how long a download URL lasts, per the secure PDF FAQ (15 of 25, an earlier partial kept). Pagination and filters, the error object and the meta reference were read from the struck file (0, 0 and 0). Calls are synchronous by default, and the five SDK repositories are generated clients from September 2023 with placeholder install commands, confirmed from clones on 5 November (9 of 15, an earlier partial kept). 15+0+0+0+9 = 24.

Abyssale 71

Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.

APITemplate.io 60

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. Per the 9 October check. Closed service under terms of use dated 8 April 2022, which can change without prior notice. The SDK repositories have no licence file (13). Privacy policy dated 21 January 2024 and a public DPA with standard contractual clauses. Request logs are kept two weeks, account data is deleted within 30 days of cancellation, and free accounts' files are purged after one year. Retention of personal data is otherwise stated only as long as reasonably needed (22). Clause 15.8 of the terms promises 60 days' written notice before a service is withdrawn, while clause 2.24 reserves the right to modify or discontinue any part with or without notice. No dated deprecation notices found (6, an earlier partial kept). Eleven sub-processors named with purpose and country, 14 days' notice of new ones in the DPA, and four storage regions listed (17). 13+22+6+17 = 58.

Abyssale 55

The MCP server uses OAuth through Auth0 with scopes per tool group (read:design, write:design, delete:design, import:design, generate:banner, read:credits and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace x-api-key with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.

APITemplate.io 48

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. Per the 9 October check. One API key per account, regenerable in the console, with a separate key per team (20). The Direct URL auth code travels in a query string by design. It is tied to one template with a quota and an expiry and is not the API key, so we took no 10-point deduction. That is a judgement call. No scopes or read-only key; the Direct URL code is the only narrow credential (5). Calls return status and URLs, not third-party content (10). Request logs kept two weeks, visible in the console and switchable off (8). The site states a completed SOC 2 Type II audit with no auditor, period or report shown, plus a security policy page and 2FA. No security.txt (404), disclosure policy or bug bounty found, the value for a bare SOC 2 claim with no report or disclosure route (5). 20+5+10+8+5 = 48.

Abyssale 35

No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.

APITemplate.io 30

APITemplate.io's terms bar robots and other automatic devices on any portion of the Site or Service, so its sites were not re-read on 5 November, and the OpenAPI file's storage host answers robots.txt with an access-denied error, so readings of that file are struck. Per the 9 October check. No x402, MPP or L402 (0). Plan prices with monthly file counts are public without a login, and no per-file or overage rate is published (10). Free plan of 50 files a month with no card (20). A person signs up in a browser to get the key (0). 0+10+20+0 = 30.