Akoya vs Basiq

Akoya

Six OpenAPI 3.1 specifications, a free self-service sandbox and read-only data endpoints behind per-consumer OAuth tokens make the API straightforward to test. Production needs a security review and a signed agreement, no price is published, and no public status page, SLA, SDK or llms.txt was found.

Basiq

Ten public OpenAPI files, an llms.txt index with Markdown twins and a free self-serve sandbox let an agent start on test data. Live access needs a 12-month plan with an unpublished platform access fee, no SLA or security.txt was found, and the privacy policy says collected content may be kept indefinitely.

Akoya

1. Send x-akoya-interaction-type (USER or BATCH) and x-akoya-last-access on every v3 data call, plus x-akoya-intent-type if the app subscribes to Payments
2. Use the id_token as the bearer token. The /token response has no access_token field, so generic OAuth libraries need adjusting
3. Treat ID tokens as valid for 15 minutes, refresh on error 602, and store the new refresh token returned by every refresh
4. Page transactions by following links.next.href unchanged. Set limit, startTime and endTime on the first call only
5. On 429 with code 1207 slow the request rate. On 5xx retry up to three times with exponential backoff

Basiq

1. Send the API key verbatim after Basic in the Authorization header of POST /token. Base64-encoding it returns a 400.
2. Send basiq-version: 3.0 on the token request, cache the bearer token for its 60 minutes, and stay under 1,500 token requests per 5 minutes.
3. Send the account holder through the hosted Consent UI in a browser with a CLIENT_ACCESS token bound to their userId. The API alone cannot create a first connection on version 3.0.
4. Poll GET /jobs/{jobId} until verify-credentials, retrieve-accounts and retrieve-transactions all read success before reading accounts or transactions.
5. Follow links.next on GET /users/{userId}/transactions. A page holds at most 500 items, and pending transactions get new ids on each refresh.