Braze vs MoEngage

Braze

The REST API covers profiles, events, sends and exports with keys limited to named endpoints, and the remote MCP server adds 71 tools under OAuth with PKCE that return no user-level personal data. No OpenAPI document, idempotency keys, published price or SLA were found, and MCP writes run without a confirmation step.

MoEngage

MoEngage publishes 36 OpenAPI files covering 140 operations, a per-endpoint rate limit table, Markdown docs and a hosted MCP server that builds drafts and leaves publishing to a person. No price, trial or self-serve signup is published, and on 17 August 2026 the Inform API in one data centre accepted requests for about 16 hours without sending the messages.

Braze

1. Use the REST host for the customer's instance, such as https://rest.iad-01.braze.com or https://rest.fra-01.braze.eu. A key sent to the wrong instance returns 401
2. Create a REST key with only the permissions the task needs. Scope and IP allowlist can't be edited later, so a change means a new key
3. Call get_workspaces first on MCP. Every other tool needs the returned workspace id as app_group_id, and the wrong workspace is a documented failure
4. Use REST for profiles, events and sends. The MCP server has no user-level tools and can't trigger a message to a named user
5. Treat "message": "success" as queued, not delivered. Add a group_id to /users/track and poll /users/track/status, and don't resend a trigger call blindly

MoEngage

1. Take the data centre number from the dashboard URL and call https://api-{dc}.moengage.com. Data can't be moved between data centres
2. Send an Idempotency-Key header (UUID v4) on V5 campaign writes and test sends, and a transaction_id on Inform alerts, which deduplicates for 5 minutes
3. Use internal event and attribute names in segment filters, and run deep_validate_segment_filters first. A wrong event name is accepted and the count later fails with no reason
4. Use in with a list for text equality in segment filters. equals returns a 400 that names no field
5. Reuse an OAuth access token until it nears expiry. The token endpoint allows 5 requests a minute and 30 per 10 minutes for each key