Alloy vs ComplyAdvantage

Alloy

Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.

ComplyAdvantage

The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person.

Alloy

1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts
2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store
3. Read alloy-ratelimit-remaining, and on 429 or 5xx wait for retry-after with exponential backoff and jitter
4. Expect running after about 25 seconds on journey applications and wait for the webhook instead of resubmitting
5. Send the workflow header with account-level keys, since inputs depend on the workflow configured

ComplyAdvantage

1. Exchange the access key and secret at POST /v3/token for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry
2. Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires
3. Create a screening configuration first and keep its configuration_identifier. Creating and screening a customer needs it
4. Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow
5. Read Ratelimit-Remaining and Ratelimit-Reset on every response. A 429 body is only API rate limit exceeded