AWS End User Messaging vs Wati

AWS End User Messaging 88

IAM with policies per action and resource ARN, service condition keys, temporary credentials and rotation. No secret travels in a URL (30). Policies can allow a single send action on one phone number or pool, and enforced spend limits, protect configurations and deletion protection bound what a credential can do. We found no read-only managed policy for the service and no confirmation step (15 of 20). API responses carry no third-party content. Inbound SMS and RCS go to an SNS topic or Connect Customer, not through API calls (10). CloudTrail logs control-plane calls as management events and the send actions as optional data events, and configuration sets publish per-message events (15). In scope for SOC 1, 2 and 3 (page updated 11 August 2026), with a vulnerability disclosure programme on HackerOne. aws.amazon.com's security.txt was renewed and now runs to 16 October 2027. No paid bug bounty was found, per the 8 October check, not re-read on 17 October. Read as the Amazon SES and Secrets Manager re-checks of 17 October read the same evidence (18 of 20).

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.

AWS End User Messaging 85

Closed service under the AWS Customer Agreement and section 29 of the Service Terms, with Apache-2.0 SDKs (20 of 30). The guide says messages are processed and stored in the Region the customer picks and encrypted at rest with service-owned keys, and both the guide and the sub-processor page say downstream carriers may route messages through other regions. We found no retention period for message data (18 of 30). Amazon Pinpoint's end of support on 30 October 2026 carried dated notices (no new customers from 20 May 2025, end of support on 30 October 2026) that say these messaging APIs continue, and the document history dates each change. No general deprecation policy found (15 of 20). The sub-processor page, last updated 28 July 2026, names the entities that sell the service and promises 30 days' notice of new ones, but the downstream carriers are not named (17 of 20).

Wati 52

Closed service with clear terms from Clare.AI Limited (8 December 2025); the MCP repository is MIT (15 of 30). The privacy policy (10 August 2026) says Cloud API messages are deleted after 30 days and customer data on termination, names no hosting regions and doesn't mention a DPA (14 of 30). Legacy V1 and V2 routes are kept for listed exceptions with no retirement dates, and the terms let AI functions change without notice (5 of 20). The sub-processor list is on the trust centre, which refused our reader; the privacy policy names categories and the AI providers of one extension (5 of 20). 15 + 14 + 5 + 5 = 39.

AWS End User Messaging 71

No dedicated MCP server. The AWS MCP Server with the aws-sms-voice skill covers guidance and can run the API calls. Send responses return only a MessageId, and 28 list actions take MaxResults (1 to 100) and NextToken (15 of 25). Describe actions take Filters and resource ID lists (16 of 20). Seven typed errors, with reason codes on conflicts (41 values), validation failures (43, plus the failing fields) and quota errors (28) (18 of 20). ClientToken on 15 create and request actions and DryRun on sends, but no idempotency token on SendTextMessage, SendMediaMessage or SendRcsMessage, so a retried send can go out twice (10 of 20). SendTextMessage requires only the destination number, and SDKs exist in every major language, but every call needs SigV4 and a first send needs a registered sender (12 of 15).

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

AWS End User Messaging 85

Read by the listing's own service models, as this run's amazon-s3 and amazon-transcribe re-checks were. The Social Messaging model last changed on 19 October 2026 (Direct Send enforcement status on WhatsApp Business Accounts, and template source and corrected category on templates), 13 days before this check, and the SMS and Voice v2 model on 12 October (a PricingTier field on DescribePhoneNumbers and DescribeSenderIds). The models repository had commits to 30 October with none touching either model since (30). In the 90 days from 3 August, SMS and Voice v2 changed on 31 August, 8 September, 2 October and 12 October, and Social Messaging on 6 August, 3 September, 17 September and 19 October, with guide changes dated 8, 15 and 22 September (20). The JavaScript clients ship with the whole SDK (3.1161.0 on 30 October) and aren't needed for the count. Closed service with a dated document history and AWS re:Post. Direct support is a paid plan (10 of 15). Official SDKs released on most working days (15). The JavaScript client needs Node 20 or later and is published from the SDK's release pipeline (10). 30+20+10+15+10 = 85.

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

AWS End User Messaging 73

AWS Health Dashboard with per-service, per-Region history (20). AWS's dashboard history file, re-read on 1 November, still lists AWS End User Messaging in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status, with no update after 15 September. On that date, inside the 90-day window from 3 August, AWS said it can't restore resources and data hosted only in me-south-1 or the mec1-az2 zone. No other event in the window names the service, and the newest event in the file is an API Gateway one in us-west-2 posted on 30 October. One major event, read as the Amazon S3, Secrets Manager and Transcribe re-checks of 1 November read the same two events (10). Quotas page gives 1 request a second for most actions, SendTextMessage included (re-read 1 November), and the throughput page gives message parts a second by sender type (15). The API model marks ThrottlingException as retryable and 15 create and request actions take a ClientToken, but the send actions take no idempotency token and we found no backoff guidance in the guide pages we read (8). The AWS User Engagement SLA commits 99.9 per cent monthly uptime per Region and names AWS End User Messaging, per the 8 October check (10). Generally available (10). 20+10+15+8+10+10 = 73.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

AWS End User Messaging 30

No x402, MPP or L402 (0). Per-message prices by country and channel published without login, with a JSON feed for SMS (20). No SMS free allowance. Push is free for the first 1,000,000 notifications a month, and new AWS customers get up to $200 in Free Tier credits. The Free Tier FAQ says most new customers don't need a payment method, though AWS may still ask for one, so half, as on the Amazon SES re-check (10). A person signs up, and production access needs a support case per Region, so no autonomous route (0).

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.