Bitstamp API vs Crypto.com Exchange API

Bitstamp API 20

No machine payment protocol (0). The fee schedule page loaded empty, the API's fee endpoints need a key, and no rate could be read, so fees are scored as not published (0, unchecked). The API is free, public endpoints need no key and the sandbox needs no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 0 + 20 + 0 = 20.

Crypto.com Exchange API 40

No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.

Bitstamp API 63

Read with the hosted lines on the HTTP API v2 at www.bitstamp.net/api/v2/. status.bitstamp.net is a Statuspage site with component history (20). Its feed for 5 August to 3 November 2026 has 17 entries, among them withdrawals failing on 14 networks for about 3 hours on 21 August, database maintenance with login failures and intermittent trading interruptions for about 1 hour 44 minutes on 23 September, a 39-minute halt of all markets on 5 August, and delistings and single-asset suspensions. One major (10). Rate limits with numbers, 400 a second and 10,000 per 10 minutes (15). Limit errors are named (400.002, 400.067, 400.068) but there is no Retry-After or backoff guidance, duplicate client order ids are allowed, and the only retry guidance is to check the order after a 500.016 timeout (8 of 15). No SLA found (0). Generally available (10). 20 + 10 + 15 + 8 + 0 + 10 = 63.

Crypto.com Exchange API 50

Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.

Bitstamp API 51

No OpenAPI or other machine-readable contract was found on the API page or elsewhere (0). No llms.txt or Markdown docs (0). The single documentation page describes each endpoint's purpose and parameters, with notes such as the 10-second cache on open orders and the Travel Rule fields, but not when to use one endpoint over another (14 of 20). Parameters are typed with enumerations (margin mode CROSS or ISOLATED, margin multiplier 1 to 25, order types) and required fields marked (11 of 15). Signing examples in Python, Java and C++, and error families with numbered codes and explanations (13 of 15). Version v2 in the path and header, a dated changelog from 7 April 2023 to 28 August 2026, and a 410.001 code for deprecated endpoints, with no stated notice period (13 of 15). 0 + 0 + 14 + 11 + 13 + 13 = 51.

Crypto.com Exchange API 42

An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.

Bitstamp API 58

Graded on the REST API. Order book grouping and transaction time windows size responses, but there is no field selection and no MCP surface (15 of 25). Offset, limit, since and sort on transaction history, until_id windows on order-data replay (14 of 20). response_code and response_explanation name the failure, such as 400.009 insufficient balance, 403.004 trading blocked and 500.025 insufficient liquidity (16 of 20). No idempotency, since client_order_id duplicates are allowed since November 2023 and the docs say only to check the order id after a timeout; the kill switch limits damage (8 of 20). Few required parameters, but no official SDK in any language (5 of 15). 15 + 14 + 16 + 8 + 5 = 58.

Crypto.com Exchange API 50

Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the market group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds -o json|table|ndjson (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs acknowledged: true, dangerous needs --allow-dangerous), --dry-run and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.

Bitstamp API 60

Revocable HMAC-SHA256 keys with per-endpoint permissions, an IP allow-list, single-use nonces, a timestamp window, sub-account scoping and a one-call kill switch for every key; no key expiry found (24 of 30). Permissions are chosen per endpoint and withdrawals can need Travel Rule address verification, but whether a withdrawal address allow-list exists sits in the unread account settings and no confirmation step is documented for API withdrawals (14 of 20). The API returns exchange data, not third-party text (10). No per-key audit log found; the account's transaction history is the record (4 of 15). security.txt names HackerOne's Robinhood programme but expired on 12 July 2026; no certification page was readable (8 of 20). 24 + 14 + 10 + 4 + 8 = 60.

Crypto.com Exchange API 54

HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without --allow-dangerous; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.