Autodesk Platform Services vs Onshape

Autodesk Platform Services 53

Read for a closed service with open SDK sources. The aps-sdk-openapi repository's last commit is 16 September 2026 (Data Management spec), with Model Derivative on 12 August (20 of 30). Two dated spec changes in the last 90 days; SDK package release dates on npm and NuGet were not read (10 of 20). Stack Overflow tags, a fortnightly expert call, a bookable onboarding call and paid ADN support; GitHub issue response was not read because the API refused us (10 of 25). No APS server in the official MCP registry was looked for because the Autodesk MCP servers page could not be read; official SDKs on npm and NuGet are current per the README badges (10 of 15). SDK CI and dependency health unread (3 of 10). 20 + 10 + 10 + 10 + 3 = 53.

Onshape 79

Read for a closed service. API release notes rel-1.223 dated 30 October 2026 (30). Six dated releases from 17 July to 30 October, three weeks apart (20). A public changelog, forum.onshape.com and api-support@onshape.com; response times were not tested (12 of 15). No Onshape-owned server in the official MCP registry, where the only match is io.github.gpambrozio/onshape; the official Go client was pushed on 31 October 2026 and the TypeScript clients in June and September 2025 (12 of 15). The Go client is generated and its CI was not read; the multi-language onshape-clients repository is archived (5 of 10). 30 + 20 + 12 + 12 + 5 = 79.

Autodesk Platform Services 34

Closed service. The APS terms of service are on www.autodesk.com and were not read, so terms clarity scores as absent (5 of 30). Privacy policy, data processing and retention statements are on the same host and unread (0 of 30). No deprecation policy or dated notices were readable; the docs pages that would carry them rendered empty (0 of 20). The status page names regional variants for the data APIs, which is the only location disclosure read; no subprocessor list was read (5 of 20). 5 + 0 + 0 + 5 = 10. These scores reflect what our reader could load, not a finding that the documents don't exist.

Onshape 60

Closed service with clear terms of 15 July 2020 naming PTC Inc. and Massachusetts law (15). The privacy policy has moved to ptc.com, which our reader could not fetch; the data disclosures page names subprocessors (AWS, Salesforce, SendGrid, Zendesk, Vanilla Forums, Crownpeak, Thought Industries, Stripe, Zuora) without retention periods, and neither the terms nor the disclosures say whether customer content trains AI (12 of 30). Deprecations are marked in dated release notes and flagged with an x-deprecated header, but no notice period is stated (12 of 20). Subprocessors are named and the status page lists hosting regions by continent; no formal data location statement was read (14 of 20). 15 + 12 + 12 + 14 = 53.

Autodesk Platform Services 0

No x402, MPP or L402 in the specs or pages read (0). Pricing is on www.autodesk.com/products/autodesk-platform-services/overview#pricing, where aps.autodesk.com/pricing redirects; www.autodesk.com/robots.txt answered 403, so no price was read and the line scores as absent (0). A free trial is referred to on the developer pages, but its terms and whether a card is needed were on the unread pages (0). A person signs in to the developer portal to create the app that holds the client id and secret (0). 0 + 0 + 0 + 0 = 0, the reading contentful, personio and coupa took on 7 October 2026 when their pricing pages were unreadable.

Onshape 22

No x402, MPP or L402 (0). Plan prices are public per user per year, with no per-call price; extra API calls are sold by sales at an unpublished rate (10). The Free plan costs nothing for non-commercial use with public documents and a Professional trial needs no card; whether the Free plan asks for a card was not stated (12 of 20). A person signs up in a browser and creates the key or OAuth app (0). 0 + 10 + 12 + 0 = 22.

Autodesk Platform Services 47

OAuth 2.0 with client credentials and authorisation code flows and named scopes (data:read, data:write, data:create, bucket scopes, code:all) in the published Authentication v2 spec, plus Secure Service Accounts for server workloads (30). Read-only scopes exist; no confirmation step before destructive calls was found (12 of 20). The engines execute add-ins and scripts on uploaded design files, and no prompt-injection guidance for agents was found on the pages read (5 of 15). No audit log or per-call visibility was found on the pages read (0 of 15). Autodesk's trust and security pages are on www.autodesk.com, unread, and aps.autodesk.com/.well-known/security.txt answered 406, and no disclosure policy, bug bounty or certification was established from the pages read (0 of 20). 30 + 12 + 5 + 0 + 0 = 47.

Onshape 63

API keys scoped to permissions, revocable, two per individual account, with a signed request scheme; OAuth 2.0 authorisation code with 60-minute access tokens and refresh tokens revoked with the user's grant; no key expiry documented (26 of 30). Permission scopes allow read-only keys; no confirmation step before destructive calls and no approval gate on the MCP server beyond the App Store subscription (12 of 20). The MCP server reads FeatureScript errors and geometry from the document and no prompt-injection guidance was found (5 of 15). API usage counts are visible under Developer settings per company or user; no per-call audit log was found (6 of 15). SOC 2 Type 2 audited annually, AES-256 and TLS 1.2 with HSTS, paid researcher testing and security@onshape.com, but no security.txt (404), no public bug bounty and no advisories page (14 of 20). 26 + 12 + 5 + 6 + 14 = 63.

Autodesk Platform Services 52

Read with the hosted lines. health.autodesk.com is an Atlassian Statuspage listing APS components (Automation API, Model Derivative, Data Management, Developer Portal, Webhooks and the data model APIs) with history feeds (20). The history page didn't render for our reader; the RSS feed holds 20 items from 22 October to 2 November 2026, none naming an APS component, so most of the 90-day window is unread (15 of 30). Rate limits and quotas are documented on pages under /en/docs that rendered as empty shells, so no number was read (0). The OSS spec documents 429 with an instruction to wait and lengthen the wait on each attempt; no Retry-After header or idempotency guidance was found (7 of 15). No SLA found on the pages read (0). The Automation API is a released product with no beta label on its overview (10). 20 + 15 + 0 + 7 + 0 + 10 = 52.

Onshape 60

Read with the hosted lines on cad.onshape.com. Atlassian Statuspage at status.onshape.com with regional CAD service components and history feeds (20). The feed holds 18 incidents from 15 August to 30 October 2026, all degraded performance, delayed imports and exports or partial signup blocks, the longest 2 hours 42 minutes of export degradation on 15 September and imports, exports and notifications not working for 1 hour 42 minutes on 11 September; no full outage of the CAD service (18 of 30). Annual API call quotas are published per plan with numbers, while per-endpoint rate limits are said to vary by endpoint with no figure (8 of 15). 429 is documented without a header or backoff timing, 402 marks a spent quota, and no idempotency guidance was found (6 of 15). The terms promise commercially reasonable efforts and no SLA (0). The REST API is generally available; the FeatureScript MCP Server is an early-access Labs feature (8 of 10). 20 + 18 + 8 + 6 + 0 + 8 = 60.

Autodesk Platform Services 52

Data Management lists support filter and page parameters and Model Derivative returns per-object properties, so responses can be narrowed on the APIs with specs; the Automation API's job outputs are files (15 of 25). Pagination and filtering on the data APIs (15 of 20). Error responses are typed in the specs with reasons and the OSS spec explains 429, though the Automation API's error catalogue was unread (12 of 20). No idempotency key or safe-retry guidance was found; WorkItems are submitted and polled (0 of 20). Official SDKs in TypeScript (npm) and .NET (NuGet), but a Design Automation job needs an AppBundle, an Activity and a WorkItem and the add-in compiled against the desktop product (10 of 15). 15 + 15 + 12 + 0 + 10 = 52.

Onshape 46

Document and element endpoints take ids and the list endpoints take limit and offset, with no field selection documented in what we read; the MCP server's tool count is unknown (12 of 25). Pagination and filters on document lists, and revisions page (a paging loop was fixed in rel-1.219) (14 of 20). HTTP codes with 401, 402 and 429 meanings; the error body shape was on the unread response codes page (10 of 20). No idempotency keys; POSTs create microversions on every edit; no readOnlyHint or destructiveHint published for the MCP tools (2 of 20). Every API key request needs a Date header, a nonce and an HMAC-SHA256 signature, and 307 redirects need a new signature; official Go and TypeScript clients handle it (8 of 15). 12 + 14 + 10 + 2 + 8 = 46.