Acuity Scheduling API vs Truto Unified Calendar API

Acuity Scheduling API 15

No changelog or release notes found. The docs' own page dates show the OAuth guide edited on 1 October 2026 and the webhooks guide on 25 June 2026, which we count as the latest dated change (10). No three dated entries in 90 days (0). A developer email address and a support form, with no public issue tracker for the API (5). The Node.js and PHP SDKs were last tagged in July 2019 (0). No current package to assess (0). Total 15.

Truto Unified Calendar API 50

No API changelog, so the last API change can't be dated; the official @truto/truto-link-sdk was published as 1.3.5 on 26 October 2026, which we take as the latest dated release (20 of 30, since it is the connection widget, not the calendar API). Six Link SDK versions since 8 August (10 of 20, for the same reason). Support through Slack on paid plans, with no public tracker (5 of 15). A CLI and the Link SDK are official, with no API client (10 of 15). Package health not checked (5 of 10). 20 + 10 + 5 + 10 + 5 = 50.

Acuity Scheduling API 44

max caps list size and excludeForms trims intake forms from appointments. No field selection (10). Filters by date, calendar, type and client, but no cursor or offset is documented, so long lists need date windows (10). Errors carry a status, a named code and a message, and a 404 suggests the nearest path (16). No idempotency key or safe-retry guidance for POST /appointments (0). Booking needs five fields and picks a calendar when none is given. SDKs exist for Node.js and PHP, both last released in 2019 (8). Total 44.

Truto Unified Calendar API 71

truto_exclude_fields, truto_ignore_remote_data, truto_key_by and response formats (unified, raw, normalized) size the reply (22 of 25). Query operators such as [gt] and [in], sort_by, limit and cursors, with a meta endpoint that says which filters each vendor supports (18 of 20). Errors name the HTTP status and say whether Truto or the provider failed, with the provider's message extracted (18 of 20). No idempotency key found for creates (5 of 20). Every call needs only the token and integrated_account_id; a CLI and the Link SDK exist, with no general API SDK found (8 of 15). 22 + 18 + 18 + 5 + 8 = 71.

Acuity Scheduling API 27

Basic authentication with one account API key, or OAuth2 with the single scope api-v1. Tokens can be disabled at /oauth2/disconnect. No scoped keys, expiry or rotation documented. Credentials travel in headers only (15). No read-only credential. Client-mode validation is the default and admin=true is opt-in (3). Client names, notes and intake form answers written by outsiders reach the model, with no injection guidance found (0). No API audit log found (0). Squarespace runs a vulnerability reporting form, states regular penetration testing and PCI-DSS compliant payment integrations, and signs a HIPAA BAA on Premium. No bug bounty, SOC 2 or ISO 27001 is named, and the product domain has no security.txt (9). Total 27.

Truto Unified Calendar API 52

API tokens are per environment and sent as Bearer headers; no scopes or expiry for them were found (20 of 30). Per-account MCP servers can be limited to read methods or tags and set to expire, and the customer's connection form can restrict access to specific resources, but the REST token reaches every integrated account in its environment (14 of 20). Event titles, descriptions and attendee text from outside parties pass through, and no prompt-injection guidance was found (0). Plans keep request logs 30 or 90 days (10 of 15). SOC 2 is stated in a 2023 blog post, with no trust page, security.txt or disclosure policy found (8 of 20). 20 + 14 + 0 + 10 + 8 = 52.

Acuity Scheduling API 58

Graded as a hosted API. Statuspage site at status.acuityscheduling.com with incident history, though one component stands for the whole product (20). In the 90 days to 8 October 2026 the feed shows a critical disruption of 2 hours 5 minutes on 19 July and one of 18 minutes on 12 August, both marked as possibly affecting all users and services, plus a four-day iOS app fault and three minor integration incidents. Read as one major outage (10). 10 requests a second and 20 concurrent connections per IP (15). The 429 body is documented, with no Retry-After, backoff advice or idempotency key for booking writes (3). No SLA found, and the Developer Terms disclaim uninterrupted service (0). The v1 API is generally available (10). Total 58.

Truto Unified Calendar API 77

Graded as a hosted service on the Unified Calendar API. Better Stack status page with components for api.truto.one health, ping and link-token endpoints and the static IP proxy, with incident history (20). The feed lists "APIs and Dashboard are down" on 29 October 2026 and delayed sync jobs and webhooks on 1 November, which counts as one major outage (10). Truto's own limit is 50 requests every 10 seconds per integrated account, in front of each vendor's (15). A vendor 429 comes back with Retry-After and normalised ratelimit-limit, -remaining and -reset headers, with no idempotency guidance for creates (12 of 15). The Enterprise plan lists an SLA guarantee (10). Generally available (10). 20 + 10 + 15 + 12 + 10 + 10 = 77.

Acuity Scheduling API 56

Each reference page carries an OpenAPI 3.1 fragment for its own operation, generated by the docs platform from hand-written pages. No single downloadable specification was found (15). llms.txt is published and every page has a Markdown copy, but the index lists only five of 36 reference pages (8). Pages explain client and admin booking modes and when availability is validated, without when-not-to-use guidance (10). Parameters are typed with required fields, but there are no enums and datetime is any string PHP's strtotime accepts (8). Request examples, an error table and per-endpoint error codes (12). The path is versioned as v1, with no changelog found (3). Total 56.

Truto Unified Calendar API 75

An OpenAPI specification is linked from the RFC 9727 API catalogue, but the file timed out and was not read, so it is credited as published and unverified (20 of 25). llms.txt and a Markdown sibling for every page (10). Parameter descriptions say what each does and what it falls back to, such as end_time defaulting to the month of start_time (15 of 20). Types, required marks and allowed values such as focus_time and out_of_office (13 of 15). One documented error shape with provider and Truto fields; few request examples on the reference pages read (12 of 15). Deprecated admin endpoints are marked, but no API changelog was found (5 of 15). 20 + 10 + 15 + 13 + 12 + 5 = 75.

Acuity Scheduling API 30

No x402, MPP or L402 (0). Plan prices are public, $20, $34 and $61 a month, with nothing per call (10). A 7-day trial needs no card. Whether the trial includes API access was not established (20). A person signs up in a browser and copies the key or approves OAuth (0). Total 30.

Truto Unified Calendar API 20

No x402, MPP or L402 (0). Plan prices per connector a year are public, with unlimited calls (10). A free 30-day sandbox is given after a work-email request reviewed within a business day (10 of 20). A person requests access or books a demo (0). 0 + 10 + 10 + 0 = 20.