Attendee vs Zoom Realtime Media Streams (RTMS)

Attendee 26

Graded on the hosted API with the hosted lines. No status page was found on the site, the docs or the README, and the footer's Status entry has no link (0). With no readable incident history the record takes the default (5). No rate limit is in the docs. The source sets defaults of 3,000 POST requests a minute per project and 2,500 concurrent bots, and the hosted values are not stated (5). No 429 response or Retry-After guidance is documented. deduplication_key makes bot and calendar creation safe to retry, and webhooks are retried 3 times (6). The terms supply the service as is with no uptime figure (0). The /api/v1 API has no beta label, though calendar integration is labelled Beta (10). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The rate-limit 5 and 429 6 are partials kept and flagged. 0 + 5 + 5 + 6 + 0 + 10 = 26.

Zoom Realtime Media Streams (RTMS) 67

Graded on the hosted RTMS service with the hosted lines. www.zoomstatus.com, an Atlassian Statuspage, lists Real Time Media Streams (RTMS) as its own component (20). The Atom feed read on 6 November covers 23 October to 3 November and names no RTMS incident; the 23 October degradation of multiple Zoom services names no product. The window from 8 August to 22 October is drawn by script and robots.txt closes /api/, so, as for zoom-scheduler, the line is 10. Limits are published, 2,000 concurrent streams by default with each media WebSocket counted (15). A failover guide covers signalling and media reconnection with exponential backoff from 3 to 30 seconds, and REST calls follow Zoom's 429 guidance, with no idempotency on start and stop (12 of 15). No SLA found for RTMS (0). RTMS for Meetings carries no beta label (10). 20+10+15+12+0+10 = 67.

Attendee 40

No x402, MPP or L402 (0). The hosted price is public without a login at $0.50 a bot hour, down to $0.35 by volume (20). Five free hours at signup. The signup page asks for an email address and password or a Google sign-in and no card, and we created no account to confirm (20). A person signs up in a browser to get a key (0). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 0 + 20 + 20 + 0 = 40.

Zoom Realtime Media Streams (RTMS) 0

No x402, MPP or L402 (0). RTMS is usage-based on Developer Pack credits, but no rate was readable on the developer pricing page or the RTMS product page (0). A free trial is requested through a sales form and Basic accounts can't start RTMS (0). A person creates the app, buys credits and submits the app for review (0). 0+0+0+0 = 0.

Attendee 33

Project API keys sent in a header, stored as SHA-256 hashes, several per project and each can be disabled. No scopes, expiry or rotation tooling was found (20). No read-only key and no confirmation before delete_data, which the docs call irreversible. Dashboard users are admins or regular users limited to assigned projects (5). Transcripts and chat are participant-written, and no injection guidance was found (0). Bot events and a bot_logs.update webhook give per-bot visibility. No audit log of API calls is documented (5). No security.txt, SECURITY.md, disclosure address, bug bounty or certification was found. The source is public and dependency updates are automated (3). Per the 9 October check, re-read from the repository on 4 November. Commits of 11 and 15 September add dashboard permissions such as who may manage API keys; API keys still carry no scopes. OSV lists nothing for this project (its one hit, MAL-2022-6154, is an unrelated npm package named attendee). 20 + 5 + 0 + 5 + 3 = 33.

Zoom Realtime Media Streams (RTMS) 63

OAuth 2.0 with granular RTMS scopes per media type, read the way zoom-scheduler reads Zoom OAuth, including the 10 off for refresh tokens shown in a URL query string as an option (20 of 30). Least privilege is strong. Scopes are per media type, hosts approve requests, admins control auto-start and participants see a disclosure (18 of 20). Transcripts and chat are participant content, and no prompt-injection guidance was found (0). Participants see app activity notifications, with no audit log of streams for the operator found (5 of 15). Zoom's security.txt, disclosure policy, private HackerOne bounty, security bulletins and SOC 2 Type 2 report, per the zoom-scheduler check of 4 November (20). 20+18+0+5+20 = 63.

Attendee 48

Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). The OpenAPI 3.1.1 file at docs.attendee.dev/api-reference/openapi.json was read on 9 October in place of the rendered reference, but no docs page read then was recorded as linking it as a visible download, and the docs host is now paused, so it isn't counted as a published contract (0). The repository carries the spec as docs/openapi.yml (OpenAPI 3.0.3, 30 operations, last changed 28 October 2026), which no read page links for download either. llms.txt and a Markdown twin of each docs page (10). Most operations have a short description, and a few state when a call is allowed, such as delete_data only after a bot has ended (9). Enums, required fields and typed settings objects, with a free-form metadata object and no security scheme, since the key is declared as a header parameter (11). The only error responses are 400 and 404 with no schema, and 401 and 429 are absent, as the repository's docs/openapi.yml also shows on 4 November (8). The path is versioned as v1, info.version stays 1.0.0, and the site changelog has dated entries up to 24 March 2026 while repository tags continue to 30 October 2026 (10). 0 + 10 + 9 + 11 + 8 + 10 = 48.

Zoom Realtime Media Streams (RTMS) 71

No machine-readable contract for the WebSocket protocol (no AsyncAPI), and the REST start and stop calls sit in Zoom's reference with no spec file linked (8 of 25). llms.txt and a Markdown copy of each page (10). Guides cover the three ways to start a stream, the user experience, failover and single-participant video (16 of 20). Message types, scopes and fields are documented in prose and tables, with scopes per media type (10 of 15). Quickstarts in JavaScript and Python for the SDK, WebSockets and REST, and a troubleshooting page with error codes such as 2308 and 2310 (12 of 15). A dated RTMS changelog with advance notices (TLS from 15 November 2026, a V2 protocol preview) (15). 8+10+16+10+12+15 = 71.

Attendee 61

The source is public under the Elastic License 2.0, which is clear but not an OSI licence and bars offering the software as a hosted service. The site and README call it open source (20). The privacy policy of 1 June 2025 states 5 days for audio and video, indefinite retention for transcripts and participant data, and deletion on request. No DPA was found, and the terms describe themselves as covering the web pages (18). No deprecation policy or dated removal notice was found (0). A sub-processor page lists seven vendors with roles and no locations, and the privacy policy says data is stored in the United States (12). Per the 9 October check, not re-read on 4 November (Attendee's terms bar robots on the non-API portions of the service). 20 + 18 + 0 + 12 = 50.

Zoom Realtime Media Streams (RTMS) 73

Closed service under the Zoom API Licence and Terms of Use of 16 July 2025, as for zoom-scheduler (15 of 30). The Privacy Statement (17 September 2026) and Terms of Service say communications-like customer content isn't used to train AI models, with no fixed retention periods, per the zoom-scheduler check; RTMS streams to the customer's own app, which holds the data (18 of 30). Advance, dated notices in the RTMS changelog, such as TLS 1.2 from 15 November 2026 and a V2 preview, beside API terms that let Zoom deprecate without prior notice (14 of 20). The sub-processor list (2 October 2026) names third parties and affiliates with locations, per the zoom-scheduler check (18 of 20). 15+18+14+18 = 65.