Chatwoot API vs FreeScout

Chatwoot API 81

Four OpenAPI 3.1 files in the repo. The Application one has 124 operations (25). llms.txt with about 200 links and Markdown copies of each docs page (10). Every operation has a description, though the API introduction says the reference can trail the real behaviour and suggests reading the web app's own requests (12). 88 enums and typed request bodies in the Application spec (12). 380 examples and 401, 403, 404 and 422 responses in the spec, no 429 (12). Product changelog with dated entries and tagged GitHub releases, but the API itself sits at v1 with no API-specific changelog (10).

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Chatwoot API 78

MIT core with an enterprise directory under a separate licence (25). Privacy policy (16 April 2025) keeps data while the account is active, plan retention runs from 30 days to 3 years on the pricing page, and the policy says customer data doesn't train generalised AI models. No DPA link in the policy (18). Dated deprecations exist, such as Captain V1 retiring on 28 September 2026 and the header auth flagged in the spec, with no general deprecation policy (12). US processing stated and a subprocessor list linked at trust.chatwoot.com, which we couldn't read (12).

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Chatwoot API 40

No x402, MPP or L402 (0). Cloud prices are public per agent per month, $0, $19, $39 and $99, with Captain AI credits at $20 per 1,000, but nothing per API call (10). Free Hacker plan for 2 agents and 500 conversations a month, and the self-hosted Community Edition is free (20). Cloud needs a person to sign up. On a self-hosted install the Platform API can create accounts, users and tokens with no human step, so we gave half (10).

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Chatwoot API 52

Per-user access tokens that act with the user's full role, revocable by reset, header only. Bearer auth shipped in v4.19.0 (20 October 2026) and the spec says the api_access_token header will be deprecated in a future release (20). Agent bot tokens can reach only bot-permitted endpoints (show and toggle status or priority, create messages, assignments and labels), which is a usable least-privilege mode. No approval step for writes (10). Conversations carry customer-written text straight to the model and we found no injection guidance (0). Audit logs on Enterprise with an audit_logs API endpoint (10). SECURITY.md routes reports through GitHub advisories and mentions rewards, and Chatwoot has published advisories in public, three of them in 2026 (CVE-2026-44706, CVE-2026-44707, CVE-2026-72719). No security.txt, and the trust centre at trust.chatwoot.com rendered nothing we could read (12).

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Chatwoot API 77

v4.19.1 tagged on 24 October 2026, 11 days before this check (30). Five releases since 6 August, v4.17.0 (19 August), v4.17.1 (27 August), v4.18.0 (17 September), v4.19.0 (20 October) and v4.19.1 (24 October) (20). Commits land daily (last on 4 November); issue replies per the 1 October check, not re-read on 4 November, when 936 issues were open and the newest open ones were from July without visible maintainer replies (12, partly met, kept). An official CLI, no official REST SDKs (5). CircleCI and GitHub Actions spec runs, Dependabot and a bundler audit config (10).

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Chatwoot API 68

Better Stack status page with 13 components, among them Application (Dashboard & API), and monthly incident history at status.chatwoot.com/incidents (20). In the 90 days to 4 November 2026 the history lists no incident for any component; the last ones were email delivery disruptions on 20 and 26 July and a Meta permissions incident on Instagram, Messenger and WhatsApp that began on 24 July and was resolved on 5 August, all before the window, and the Application bar reads 99.987% for 30 days (30). Rate limits are published only for self-hosted installs (3,000 requests a minute per IP by default, widget routes from 6 requests per 12 hours to 60 an hour), not for Cloud (8, partly met, kept). No documented 429 or Retry-After behaviour and no idempotency guidance (0). No SLA found on any Cloud plan (0). The Application API is GA (10).

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.