ComplyCube vs Socure RiskOS

ComplyCube

A sandbox with its own key and scripted outcomes, a public OpenAPI spec, Markdown docs and an audit log API suit an agent running verification checks. Each environment has one unscoped key, no idempotency keys were found, and the only published terms are undated and read as website terms.

Socure RiskOS

A public OpenAPI file, llms.txt, 15 documented error codes and dated release notes cover a ten-operation REST API, and Socure Launch publishes prices from $0.80 an evaluation with a free sandbox. API keys carry no scopes, no idempotency header is defined, no service terms are published, and production stays at zero requests until Socure activates it.

ComplyCube

1. Send the key bare in the Authorization header, with no Bearer prefix. Keys start test_ or live_
2. Create a client first, then documents or live photos for it, then POST /v1/checks with the client and upload IDs
3. Stay under 10 requests a second live and 5 in the sandbox. On 429, back off exponentially with jitter, starting at 30 seconds
4. A badly formed filter returns 200 with no results, so check filter names before trusting an empty list
5. Checks are asynchronous. Subscribe to webhooks, verify the ComplyCube-Signature HMAC-SHA256 header, and expect duplicate and out-of-order events

Socure RiskOS

1. Send Authorization: Bearer <key> to https://riskos.sandbox.socure.com/api/evaluation for tests and https://riskos.socure.com/api/evaluation for live checks. The two environments use separate keys.
2. Use dummy data only in the sandbox. It returns predefined results, connects to no live data source and expects the documented test values.
3. Store the eval_id from every POST /api/evaluation response. No list or search endpoint exists to find it later.
4. On 429 wait the seconds given in X-Retry-After. Do not blindly resend a failed POST /api/evaluation, because no idempotency header is documented and Launch bills each initiated evaluation.
5. The MCP server at https://mcp.riskos.socure.com/sandbox reads docs, workflows and webhooks with its own MCP Server Key. It cannot run evaluations or read results.