AssemblyAI Voice Agent API vs Vaani Developer Platform

AssemblyAI Voice Agent API 65

Scored with the hosted lines. Statuspage at status.assemblyai.com with component history, read from history.atom on 2 November, but its components are the Asynchronous API, Streaming API and LLM Gateway and none is the Voice Agent API (15 of 20). Thirteen incidents from 4 August to 2 November 2026 (14 August to 28 October) and none names the Voice Agent API. Four touch the realtime speech-to-text it runs on, all partial. New EU streaming sessions were refused for 12 minutes on 19 August, with 30 minutes of added latency on the US endpoint on 25 August, two hours of rejected Universal-3.6 Pro Realtime sessions on the US endpoint on 6 October (the EU endpoint unaffected), and some Real-time sessions failing with 502 after a temporary-token change on 28 October until it was rolled back. Whether agent sessions were affected isn't stated. Read as minor incidents touching the product, as assemblyai-stt reads the same feed (20, was 15, which isn't a checklist value). A per-account concurrent-session limit is enforced and no figure is published for it (0 of 15). The events reference (re-read on 2 November) names at_capacity, concurrency_exceeded and internal_error as the only retryable codes and says to reconnect with backoff, and sessions resume for 30 seconds. Webhooks carry a stable event_id. No idempotency key on POST /v1/agents (10 of 15). A Service Level Agreement of 99.9 per cent a month with credits, written against an Order Form, per the 9 October check (10). No beta label on the Voice Agent pages (10). 15+20+0+10+10+10 = 65.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

AssemblyAI Voice Agent API 83

An AsyncAPI 3.0 file describes the socket and an OpenAPI 3.0.3 file the token endpoint. No description file was found for the agents, sessions and webhook REST endpoints, and the AsyncAPI file lacks language_codes, voice_focus, transcript.agent.delta and is_error, which the docs added on 23 July 2026 (19 of 25). llms.txt, a Markdown copy of each page and a docs MCP server (10). Operations and fields say what they are for and when to use them, such as when to choose hold over interactive execution (17 of 20). Enums, ranges and defaults on audio encoding, turn detection and timeouts. Tool parameters are a JSON Schema the server does not validate at session.update (12 of 15). Examples in cURL, Python and JavaScript, and tables of session error codes with close codes (13 of 15). A dated public changelog tagged by product and a /v1 path, with no written versioning policy found (12 of 15).

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

AssemblyAI Voice Agent API 68

A closed service with a clear service agreement. The starter repositories have no licence file (15 of 30). The Terms of Service grant a licence to train on Customer Data by default, the opt-out needs a paid plan, and the retention page gives periods for streaming, sync, dictation, asynchronous and LLM Gateway data but none for Voice Agent sessions, which are recorded and stored. A DPA is published and the privacy policy states Data Privacy Framework certification (14 of 30). The changelog dates deprecations ahead of time, such as the 11 July 2026 notice of a change on 7 August, and the terms promise reasonable prior notice of major changes. No written deprecation policy was found (12 of 20). The subprocessor list at /legal/subprocessors redirects to a Vanta trust centre whose robots.txt disallows every path, so it is unread. US and EU endpoints are mentioned, with no EU host named for the Voice Agent API in the pages read (10 of 20). 15+14+12+10 = 51.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

AssemblyAI Voice Agent API 0

No x402, MPP or L402 (0 of 40). On 2 November the pricing page lists speech-to-text, dictation, text-to-speech and LLM Gateway prices but no Voice Agent API price, and the billing docs have no Voice Agent section. The $4.50 an hour rate the 9 October check read on both is no longer published, and no other price page was found (0, was 20). The billing docs now say new accounts' $50 of credit applies to pre-recorded and real-time speech-to-text, Speech Understanding and Guardrails, without naming the Voice Agent API, where on 9 October they said it was covered (0, was 20). A person has to sign up in a browser to get the first key, and no key-creation API was found (0). 0+0+0+0 = 0.

Vaani Developer Platform 22

No x402, MPP or L402 (0 of 40). The ₹1 ($0.02) a minute platform fee, number rental, concurrency lines and add-ons are public, and the calculator shows each provider's unit rate without a login. Registry checks, extraction and evaluations "can add separate charges" that aren't priced, and the billing pulse depends on the account, so 3 off (17 of 20). The home page says "Start free on Vaani's Platform", but the pricing page states a prepaid wallet with no free credit, trial minutes or card rule, and we didn't sign up to check, so 5 of 20. A person signs up with email verification at platform.vaani.dev and creates keys in the dashboard (0). 0+17+5+0 = 22.

AssemblyAI Voice Agent API 55

Plain API keys per project, created and deleted in the dashboard, with no scopes or expiry found (20 of 30). Browser clients pass a token in the token query parameter. We took no deduction because the token is one-time and redeemable for at most 600 seconds, which is a judgement call, as for assemblyai-stt. A read-only Reader role exists for dashboard members but not for keys. HTTP tool header values are write-only and encrypted at rest, tool calls go only to public https hosts with redirects refused, and the docs show how to gate tools by conversation state. No built-in confirmation step before a tool that writes (10 of 20). Caller speech and tool results reach a model. Tool arguments are drawn only from user turns and tool results since 26 August 2026 and tool responses are capped, but no prompt-injection guidance was found (8 of 15). Sessions keep a timeline with tool calls, webhook deliveries are logged per session, usage is broken down by key, and the dashboard has activity logs (12 of 15). The security page states a SOC 2 Type 2 report (per the 9 October check, not re-read on 2 November), the trust centre is on app.vanta.com, whose robots.txt disallows every path, and no bug bounty, disclosure policy or public advisory was found. www.assemblyai.com's robots.txt closes /.well-known, so security.txt is unread. Read as assemblyai-stt on the same evidence, a SOC 2 claim with no disclosure route (5, was 12). 20+10+8+12+5 = 55.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

AssemblyAI Voice Agent API 72

Scored as an API. Events are small typed JSON, HTTP tool responses are capped at 8 KiB before they reach the model, and the session list leaves artefacts out (18 of 25). GET /v1/sessions pages by cursor with limit from 1 to 200 and filters on status and agent_id (18 of 20). Errors carry code, message and sometimes param, and REST validation errors name the field (17 of 20). No idempotency keys on REST writes. Sessions resume within 30 seconds, webhooks dedupe on event_id, and hold mode silences the agent during long tools (10 of 20). An agent needs three fields (name, system_prompt, voice). The official Python and Node SDKs have no Voice Agent client, so callers write JSON over a socket or start from the two starter repositories (9 of 15).

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.