CloudConvert API vs pdfRest API Toolkit

CloudConvert API 71

API keys are created with any of six scopes and can be revoked, and OAuth 2.0 issues tokens for third-party clients, though the implicit grant is still supported and no key rotation is documented. Signed URLs carry an HMAC signature, not the key (27). A key limited to task.read is read-only, and the MCP server asks for three scopes, one of them task.write, plus the two webhook scopes for its webhook tools. No confirmation step for deletes (12). Results come back as download links, and the metadata and capture-website operations handle untrusted content. The MCP page tells users to connect only the official URL, with no prompt-injection guidance (6). The security page says all access is logged and reviewable by the customer in activity logs, and jobs can be filtered by API key (11). ISO 27001 from TÜV Süd, and a valid security.txt (re-read on 1 November, Expires 2027-05-01) with a disclosure policy and rewards only at CloudConvert's discretion, so no formal bounty. No public advisories and nothing on OSV for the SDK packages. That's above ahasend's 12 (ISO 27001 and a disclosure route, no security.txt) (15). 27 + 12 + 6 + 11 + 15 = 71.

pdfRest API Toolkit 37

One Api-Key header per account, revocable per the terms, with no scopes, expiry or rotation guide, and the polling guide shows a Bearer header instead (14). No read-only key; /delete removes uploaded files and there is no confirmation step, though demo output is watermarked (4). Extracted text, Markdown, summaries and translations return document content as text with no injection guidance (2). The container edition logs audit events; nothing documents per-call visibility for cloud accounts beyond usage counts (5). SOC 2 Type 2 through Datalogics' trust centre, HIPAA BAAs and a DPA, but no security.txt, disclosure policy or bug bounty found (12). 14 + 4 + 2 + 5 + 12 = 37.

CloudConvert API 59

No OpenAPI document was found in the docs or llms.txt. GET /v2/operations returns each operation's options with types, defaults and enum values, which is a machine-readable contract for options only. The MCP tool schemas sit behind OAuth and were not read (10 of 25). llms.txt, now listing 23 pages, and a Markdown twin of every docs page (10). The reference states what each endpoint does and when the synchronous variants are a poor choice, and the MCP tool list gives one line a tool, per the 9 October check (12). Task parameters are typed in the docs, but format options are found at run time through the operations endpoint and createJob takes an arbitrary task graph (10). Every operation has a raw request, CLI, cURL and SDK example, and the docs show 422, 429 and failed-task bodies with codes, with no full code list (11). The /v2 prefix and pinnable engine versions, with no changelog found (6). 10 + 10 + 12 + 10 + 11 + 6 = 59.

pdfRest API Toolkit 90

Public OpenAPI 3.1.1 at api.pdfrest.com/pdfrest-openapi.json, version 2.58.0, 60 operations on 59 paths (25). llms.txt on pdfrest.com with the endpoint list and pricing; docs.pdfrest.com has no Markdown twins (10). Every operation has a description that says what it does, links its tool page and notes Pro-tier gating, and the merge description explains ordering with pages[] and type[]; nothing says when not to use a tool (14). 88 enums, required lists on 248 schemas, an ErrorResponse schema and a oneOf for sync against async replies (13). 120 examples in the document, API Lab generates code in six languages, and 400, 401, 404, 408, 422, 500 and 503 are documented (13). Release notes dated per version, the document carries its version, and the OpenAPI endpoints were added on 17 September 2026 (15). 25 + 10 + 14 + 13 + 13 + 15 = 90.

CloudConvert API 80

Graded as a hosted service. Status page at status.cloudconvert.com (Better Stack) with nine components and 90-day bars (20). The incident list and RSS feed, re-read on 1 November, add one incident since 9 October, "iWork and Web are down" on 12 October. iWork recovered within two minutes and Web, the web interface rather than the API, recovered at 11:51 UTC on 13 October. With the EU Central slowdown on 8 October (from about 15:25 to 16:45 UTC), the US East, iWork and EU Central alert on 14 September and the other short incidents since 3 August, each touched one region, one conversion type or one component, so minor incidents only (20). Limits on creating jobs and tasks are described as dynamic, with X-RateLimit-Limit and X-RateLimit-Remaining headers and a free-plan cap of 5 concurrent tasks. The new ai/agent tasks have a fixed 6 requests a minute and 60 an hour, but the main endpoints have no fixed number per plan (8). A 429 carries Retry-After in seconds and the docs say CloudConvert retries retryable errors itself. No idempotency key (12). The terms promise 99.9 per cent monthly uptime with refunds on paid plans, re-read on 1 November (10). API v2 is generally available and the MCP server carries no beta label. Only the new ai/agent task is marked beta (10). 20 + 20 + 8 + 12 + 10 + 10 = 80.

pdfRest API Toolkit 58

Read with the hosted lines. status.pdfrest.com is an Upptime page with a single check on the /up endpoint, backed by a public repository with daily history; one component and no incident write-ups (15). The repository shows 100 per cent uptime over 7 and 30 days, 99.95 per cent over a year and no down entries in the last 200 daily history commits (30). No request rate limit is documented and the OpenAPI document defines no 429 (0). A 408 timeout is documented and /request-status polls async jobs, but there is no 429 handling, backoff guidance or idempotency key (3). No SLA; the terms give the service as is (0). GA (10). 15 + 30 + 0 + 3 + 0 + 10 = 58.

CloudConvert API 75

Closed service with terms (12 April 2022) that cover API use, and MIT SDKs (18). The privacy policy, now dated 19 October 2026, gives 24 hours for files, 72 hours for account data after deletion and 180 days for logs, which agrees with the docs' 24-hour task deletion. The 19 October update adds the AI chat and AI tasks, an AI log of requests, file names and results kept 180 days and used to fix errors and to evaluate and train the AI models for these functions, with an opt-out in the dashboard that deletes existing logs, which the AI docs repeat. A DPA is signed on request (25). No deprecation policy. The terms give 30 days' notice only if the whole service is discontinued, and the operations endpoint flags deprecated engine versions (5). Hosting, payment, support and AI companies are named with addresses (Claude through Amazon Bedrock in EU data centres, Qwen through OVHcloud), and regions are Germany and Virginia, with no separate sub-processor list (16). 18 + 25 + 5 + 16 = 64.

pdfRest API Toolkit 62

Closed service with terms and a privacy policy that name Datalogics, Inc. (15). Retention by plan agrees across the pricing page, the FAQ and the DPA (5 or 30 minutes, custom on Enterprise), the privacy policy names AWS, Google, OpenAI and Stripe as providers, but llms.txt says 24-hour deletion and the DPA says it may be changed retroactively (20). Release notes record changes, and 2.56.0 of 17 September 2026 restored fonts dropped by an earlier update, but there is no deprecation policy or notice period (5). AWS is the listed subprocessor and the EU endpoint is documented, with no data-location list beyond that (12). 15 + 20 + 5 + 12 = 52.

CloudConvert API 58

cloudconvert-cli 3.0.2 was published to npm on 21 October 2026 and adds an ai/agent command for the new AI tasks, which the privacy policy's dated entry of 19 October also records (30). In the 90 days from 3 August, the MCP server launch post (3 September), and Java 1.2.5, Ruby 1.2.0 (both 24 August) and CLI 3.0.2, the package tags counted half, so 2.5. The privacy policy's dated entry of 19 October records a policy text, not a release, and the ai/agent launch it describes is already counted through CLI 3.0.2 (0). No changelog. Support is a contact form and email, and dependency pull requests on the Java and CLI repositories were merged on 5 October and 23 October 2026. Issue replies were not read (8 of 15). Six official SDKs, four released in 2026. The Node.js SDK's last tag is still April 2025 (3.0.0) and the Python SDK's March 2022, and the MCP server is not in the official registry, searched on 1 November (12). Every SDK repository has a test workflow (8). 30 + 0 + 8 + 12 + 8 = 58.

pdfRest API Toolkit 70

Read as a closed service. 2.56.7 released 14 October 2026 (30). Nine dated releases between 7 August and 14 October 2026 (20). Support through a Jira service desk and email on paid plans; Datalogics links a Discord; no public issue tracker for the API (10 of 15). Code samples in six languages are kept on GitHub, but no official SDK package was confirmed (5). The status repository's CI runs daily; nothing else to assess (5). 30 + 20 + 10 + 5 + 5 = 70.

CloudConvert API 61

The MCP docs, re-read on 1 November, list 34 tools, up from 24, adding docs lookup, task cancel, retry and delete, job and task deletion, metadata writing and three webhook tools. That's above 30 and the tools have no toolsets or read-only subset, and the API returns links and status objects with an include parameter for the larger parts (6). List endpoints take per_page (100 by default, 1,000 at most), page, and filters by status, tag, operation and API key (17). Errors carry a code and a message, validation errors name the field, and failed tasks report codes such as OPEN_FAILED and, for AI tasks, AGENT_DECLINED and AI_RATE_LIMIT_EXCEEDED (15). No idempotency key. Jobs take a tag, a retry endpoint creates a new task, only successful conversions are charged, and the docs ask callers not to retry automatically. MCP annotations were not read (8). A job needs three short tasks, and there are official SDKs in six languages and a CLI (15). 6 + 17 + 15 + 8 + 15 = 61.

pdfRest API Toolkit 52

Responses are small JSON bodies with output ids and URLs, and /pdf-info takes a queries list to size its answer (18). Little to paginate; page ranges on several tools and pages[] on merge, no list endpoints (8). Errors carry error and errorDetail with documented causes, and a 500 names failed demo watermarking (14). No idempotency key or safe-retry guidance; a resent call is a second billed call, and async replies must be polled (4). Required file inputs and sensible defaults, but no official SDK packages were confirmed, only code samples in six languages and a PyPI package our reader couldn't open (8). 18 + 8 + 14 + 4 + 8 = 52.