ComplyAdvantage vs Middesk

ComplyAdvantage

The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person.

Middesk

A public OpenAPI 3.1 contract for 87 operations, llms.txt, Markdown docs and a dated weekly changelog make the REST API readable to an agent, and OAuth has a read-only scope. Access is sales-led. No price, self-serve signup or official SDK was found, and the hosted MCP server rejects sandbox keys.

ComplyAdvantage

1. Exchange the access key and secret at POST /v3/token for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry
2. Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires
3. Create a screening configuration first and keep its configuration_identifier. Creating and screening a customer needs it
4. Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow
5. Read Ratelimit-Remaining and Ratelimit-Reset on every response. A 429 body is only API rate limit exceeded

Middesk

1. Match the key to the host. mk_test keys work only at https://api-sandbox.middesk.com/v1 and mk_live keys only at https://api.middesk.com/v1
2. Name the orders on POST /v1/businesses. Omitting them places a verification order plus every package the account runs automatically, all billed
3. Send address_line1 and address_line2. The API ignores address_line_1 without an error
4. A 201 means the business was created, not verified. Wait for the business.updated webhook or poll until status leaves pending
5. Stay under 20 requests a second per account, and in sandbox wait the seconds in Retry-After after a 429 on business creation