Coinbase Advanced Trade API vs KuCoin

Coinbase Advanced Trade API 80

Public OpenAPI 3.1 spec (45 paths, 51 operations) and an AsyncAPI document (25). llms.txt and a Markdown twin of every docs page (10). Every operation has a summary and description, some one line, several with multi-sentence guidance for equities (14 of 20). Enums on product_type, granularity, order_status, time_in_forces, order_types, order_side and sort_by, with defaults (13 of 15). Examples in the docs and the sandbox's simulated errors, but the spec documents only a default error referencing grpc.gateway.runtime.Error, with no 4xx or 429 shapes (8 of 15). Paths carry /api/v3, the CDP changelog is dated, and the INTX retirement was announced with a date, but the spec's info.version is 0.1 and the October gateway change has no changelog entry (10 of 15). 25 + 10 + 14 + 13 + 8 + 10 = 80.

KuCoin 60

No OpenAPI or other machine-readable contract was found; the docs link a Postman workspace and the universal SDK is generated from an internal spec (8 of 25). No llms.txt; the skills hub ships Markdown SKILL.md files with endpoint tables for seven product areas, read-only (6 of 10). One docs page per endpoint with a description, permission and weight, but no when-to-use guidance (12 of 20). Typed parameter tables with enums for type and side and required flags (11 of 15). Request and response examples per endpoint and a unified six-digit error code scheme introduced with V2 (10 of 15). Dated changelog with V1 to V2 versioning (13 of 15). 60.

Coinbase Advanced Trade API 57

Read as a closed hosted service. The last change to the API itself is the Global Derivatives gateway and INTX retirement of 1 October 2026, 33 days before this check; the Python SDK's v2.0.0rc1 is from 30 September (20 of 30). Dated changes in 90 days are the 1 October migration and the agents entries of 17 and 21 August, which run through Advanced Trade (12 of 20). A public changelog and a CDP Discord; SDK issues not read (8 of 15). Official Python SDK current, the rest samples (12 of 15). SDK CI not read (5 of 10). 20 + 12 + 8 + 12 + 5 = 57.

KuCoin 73

Read as a closed hosted service. The changelog's newest past entry is 2 November 2026 and the universal SDK was pushed 15 September (30). Nine dated changelog entries since 5 August 2026 (20). A Telegram API group (t.me/KuCoin_API) and api@kucoin.com for limit requests, no public issue tracker for the API; the SDK repository's issues were not checked (10 of 25). Official SDKs current in five languages, no MCP registry presence (13 of 15). No package health signal checked (0 of 10). 73.

Coinbase Advanced Trade API 20

No machine payment protocol on the API (0). The fee schedule answered a bot check on 3 November 2026, so no per-trade price was read, and the docs give none (0 of 20, unchecked). Six public market endpoints and the sandbox need no key or card (20). A person signs up, passes verification and mints a key in the portal (0). 0 + 0 + 20 + 0 = 20.

KuCoin 35

No machine payment protocol (0). The spot base fee is stated in support articles without login, the futures base rate and the full tier table sit in images or behind script (15 of 20). Market data needs no key, no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 35.

Coinbase Advanced Trade API 58

Read with the hosted lines. status.coinbase.com is a Statuspage site with Coinbase Advanced Trade, API, US Derivatives and International Derivatives components (20). The incidents feed we could read runs from 16 September to 3 November 2026. In it Advanced Trade was degraded for 25 minutes on 21 September, the website had a 3-minute major on 14 October, converts were down 1 hour 4 minutes on 26 October, and no incident named the API; 5 August to 15 September was beyond the feed, so minor only for the seven weeks read (15 of 30). No REST rate limit with numbers was found; the older rate-limits page answers 404 and llms.txt lists none, while the WebSocket page gives 8 connections and 8 unauthenticated messages per second per IP (5 of 15). Orders take a client_order_id, but no 429 or Retry-After guidance was found for Advanced Trade (8 of 15). No SLA (0). REST and WebSocket are generally available; the Global Derivatives gateway is a month old and not marked beta (10). 20 + 15 + 5 + 8 + 0 + 10 = 58.

KuCoin 45

Graded with the hosted lines on the API at api.kucoin.com. No status page found (status.kucoin.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per VIP level with per-endpoint weights and IP limits for public endpoints (15). Every response carries gw-ratelimit-limit, gw-ratelimit-remaining and gw-ratelimit-reset, 429000 is documented with a wait rule, and orders take a clientOid the docs recommend as a UUID (15). No SLA (0). The UTA V2 API is the production surface (10). 45.

Coinbase Advanced Trade API 68

CDP keys with view, trade and transfer permissions, a portfolio restriction, an optional IP allowlist, revocation in the portal, ES256 JWTs that expire after 2 minutes, and OAuth2 with wallet:* scopes for other people's accounts; no key expiry (28 of 30). View-only keys and portfolio scoping limit an agent, and transfer is a separate permission, but no withdrawal address allow-list for API keys and no confirmation step were found (14 of 20). The API returns no untrusted content (10). key_permissions reports a key's scope and account activity shows in the app, but no per-call log was found (6 of 15). HackerOne bug bounty named in a security.txt that expired on 1 June 2024; certifications unread behind a bot check (10 of 20). 28 + 14 + 10 + 6 + 10 = 68.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

Coinbase Advanced Trade API 67

The editorial half. A closed service whose user agreement answered a bot check; the OpenAPI spec is public and the Python SDK is open on GitHub (12 of 30). Privacy facts per the coinbase-cdp-agentkit check of 1 October 2026 (Coinbase, Inc., processing countries, retention tied to need without numbers), not re-read (10 of 30). INTX endpoints retired on 1 October 2026 with a dated notice and a read-only grace period (12 of 20). Processing countries and provider categories per the same earlier check, no subprocessor list (8 of 20). 12 + 10 + 12 + 8 = 42.

KuCoin 54

The editorial half. A closed hosted service with terms that are clear on use, liability and law but name no company (12 of 30). The privacy policy gives retention periods by purpose and provider (2 years after closure, 14 months for Firebase, 3 years for Jumio, 5 years for Sumsub) and names 41 services, with no data centre locations (22 of 30). Endpoints are removed and fields deprecated in dated changelog entries with no notice period or policy (8 of 20). Third parties named by service, locations not stated beyond transfers around the globe (10 of 20). 52.