Apiroc Unified Calendar API vs SavvyCal API + MCP

Apiroc Unified Calendar API 35

No public status page with history. status.apiroc.com doesn't resolve and the homepage shows only an "All systems operational" badge with a claim of 34B+ API calls (0). No readable incident history (5). Rate limits published with numbers, 20 requests a second in Sandbox and 300 in Production per application, plus 600 a minute per Google account and 1,000 a minute per Microsoft account (15). The docs don't mention 429 or Retry-After, though the official Node SDK reads a retry-after header on 429, and webhook docs say to dedupe on svix-id (5). The terms say availability can't be guaranteed, and no SLA was found on any plan (0). GA, with production use licensed on Pro (10).

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Apiroc Unified Calendar API 44

No OpenAPI spec. A Postman collection is the only machine-readable contract (10). No llms.txt, per the 30 September check (0). Reference pages for five resources with parameters and cURL, TypeScript and Python examples, but little on when to use one endpoint over another (10). Typed inputs in the Node SDK and required fields marked in the docs (10). Examples throughout, and an errors page that gives only the shape (error, message, requestId) and the 2xx, 4xx and 5xx ranges, with no list of error names (9). /v1 in the path but no changelog (5).

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.

Apiroc Unified Calendar API 21

Your application calls with one x-api-key that reaches every connected end-user account, and we found no key scopes or rotation docs (10). Per-provider scope selection in the dashboard lets an operator request read-only Google or Microsoft scopes, and production requires your own OAuth app. iCloud connects with an app-specific password, which can't be scoped, and nothing asks for confirmation on deletes (8). Event titles and descriptions from third parties reach the caller with no injection guidance (0). Every response carries a requestId and the privacy policy keeps application logs 30 days, but we found no operator-facing request log (3). No security.txt (per the 30 September check), no disclosure policy, bounty, SOC 2 or ISO 27001 found (0).

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Apiroc Unified Calendar API 62

Node SDK v2.0.1 on 5 August 2026, 57 days before this check (20). Four SDK releases since 3 July (v1.2.2, v1.3.0, v2.0.0, v2.0.1) (20). No public changelog. Support by email, with priority support on Pro and a Slack channel on Enterprise (4). One current official SDK, in Node (10). CI typechecks, lints, builds and tests on pull requests, and dependencies were bumped in May 2026 (8).

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Apiroc Unified Calendar API 51

Closed service with terms under Albanian law and an MIT Node SDK (15). Privacy policy (24 August 2026) says event content isn't stored persistently, application logs and analytics are kept 30 days, data isn't used to train models, and Google's Limited Use rules apply. A DPA is published. Webhooks are delivered through Svix, which isn't on the sub-processor list, and webhook message retention has no period (18). 30 days' notice for price rises and sub-processor changes, but no API deprecation policy (3). Five sub-processors listed with locations, and servers stated as US. Svix missing (15).

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.

Apiroc Unified Calendar API 40

No x402, MPP or L402 (0). Plan prices and $0.50 per extra end-user account a month published without login (20). Free plan for 10 end-user accounts with no card (20). Browser signup and a dashboard key, no autonomous route (0).

SavvyCal API + MCP 30

No x402, MPP or L402 (0). Per-seat plan prices public, nothing per call (10). A Free plan with the API, webhooks and MCP server included and no card mentioned, though booking through a link needs Basic or Premium and there is no self-serve trial (20). A person signs up in a browser and approves the OAuth consent (0). 0 + 10 + 20 + 0 = 30.