Aurinko Calendar API vs YouCanBookMe API

Aurinko Calendar API 66

Public OpenAPI 3.0.0 spec with 112 paths and 154 operations (25). llms.txt and a Markdown copy of every docs page (10). Every operation has a summary but only 17 have a description, and 193 of 893 schema properties are described (8). Enums appear in 44 of 190 schemas, but only two schemas mark required fields (8). 110 operations carry a cURL sample and the Errors section shows the JSON body, though operations declare only 401 and a default response (10). /v1 in the path and spec version 1.0.0, with no changelog found (5).

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Aurinko Calendar API 56

Graded on the REST API. returnRecord=false trims write responses to an ID and reads take timeMin and timeMax, but no field selection was found (12). pageToken on lists, limit and offset on booking profiles, and delta tokens for incremental sync (16). Errors carry code, message, requestId and the provider's originalError, with retry advice per status (14). No idempotency keys. If-Match with an ETag is required on event updates, and reserveForMinutes holds a slot before a booking is confirmed (8). primary works as a calendar ID and few parameters are required, but no official SDK was found (6).

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Aurinko Calendar API 40

Graded as a hosted API. No status page is linked from the site, the docs or the spec, and status.aurinko.io did not resolve (0). With no readable incident history the record scores 5. The spec gives a limit of 250 requests a second (15). It advises exponential backoff on 429 and 5xx and a retry on 408, with no Retry-After header documented and no idempotency keys for event or booking writes (10). No SLA found, and the terms supply the service as is (0). The API is at /v1 with no beta label (10).

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Aurinko Calendar API 41

Per-user OAuth with 11 scopes, Calendar.Read separate from Calendar.ReadWrite, and DELETE /v1/account/token to revoke. The application's client ID and secret, sent as Basic auth with X-Aurinko-Account-Id, reach every connected account, and the implicit grant is still supported though not recommended (22). A read-only scope exists, with no confirmation step for deletes (12). Event content from third parties is returned with no injection guidance (0). No operator audit log found in the docs (0). A security statement with a reporting address, security@yoxel.com, and penetration tests claimed. SOC 2 is not yet held, with no bug bounty and no security.txt (7). rescheduleToken travels in the query string on booking calls. No deduction, because it is not the API credential.

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Aurinko Calendar API 45

Closed service under a Terms of Services Agreement naming Yoxel, Inc. of California, last updated 11 August 2022 (15). The docs say content is passed through and never stored, with only IDs cached, and the privacy policy commits to Google's Limited Use requirements. The policy gives no retention period, and no DPA was found (12). No deprecation policy or dated notices found (0). No sub-processor list or data location. The security statement names no cloud provider (0).

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.

Aurinko Calendar API 40

No x402, MPP or L402 (0). Prices per active account a month published without login, $1, $1.50 and $2 (20). A 14-day trial with no card (20). Signup is in a browser at app.aurinko.io, and each calendar needs its owner's OAuth consent (0).

YouCanBookMe API 30

No x402, MPP or L402 (0). Seat prices public in the help centre's pricing article (Individual $9, Professional $13, Teams $18 a month, less yearly and over two years); the pricing page's own figures did not render for us, and nothing is priced per call (10). A Free plan and a 14-day trial of every feature with no card (20). A person signs up in a browser and the Account Owner generates the key by hand (0). 0 + 10 + 20 + 0 = 30.