Belvo vs Yodlee Core API

Belvo

Belvo publishes a 146-operation OpenAPI file, an llms.txt with a Markdown twin of each docs page, and list endpoints with field selection and pages of up to 1,000. Production access needs a sales meeting, a certification call and a paid plan from 1,000 USD a month, and no changelog or maintained SDK was found.

Yodlee Core API

A public Swagger 2.0 file covers 98 operations with per-operation error codes, and tokens last 30 minutes and are bound to one end user. No price, service terms, status page, rate limit or SLA is published, there is no official server SDK, and the sandbox is limited to five preconfigured users with sample data.

Belvo

1. Send HTTP Basic with secretId as username and secretPassword as password to https://sandbox.belvo.com, and switch to https://api.belvo.com only with production keys
2. Create links through the Hosted Widget with a token from POST /api/token/, which expires after 10 minutes
3. Read stored data with GET list calls. Each POST retrieval in Brazil counts against monthly Open Finance limits, such as 8 a month per CPF for owners and accounts
4. Retry 50x responses up to five times from a 3 second base with a factor of two, and don't retry 40x apart from too_many_sessions
5. Send Belvo-Idempotency-Key with a UUID when creating a payment intent, and X-Belvo-Request-Mode: async on link deletion to avoid the limit of 5 deletions a minute

Yodlee Core API

1. Get a token with POST /auth/token, sending Api-Version: 1.1 and the end user's loginName as headers and clientId and secret in a form body. Reuse it for up to 30 minutes
2. Use the admin loginName only for administrative calls such as webhook subscriptions. A token made with a user's loginName reads only that user's data
3. In the sandbox, pick one of the five preconfigured users. Registering new users is not supported there
4. Page GET /transactions with skip and top (1 to 500). Without dates it returns the last 30 days, and at most two years with fromDate and toDate
5. A person must link accounts in FastLink 4 first. Then read GET /providerAccounts for link status before GET /accounts
6. Subscribe to DATA_UPDATES or REFRESH webhooks, or poll GET /dataExtracts/events in windows of at most 60 minutes, and do not poll accounts in a loop