ConvertAPI vs Nutrient DWS Processor API

ConvertAPI 54

Hosted lines. status.convertapi.com is a Checkly dashboard drawn by script, so its components were not confirmed (10 of 20) and no history could be read (5). Concurrency per plan is published (1 to 4 concurrent conversions), with no request-rate figure (12 of 15). Under load the API answers 503 and llms.txt gives a 5, 10 and 15 second retry pattern; no 429, Retry-After or idempotency key (12 of 15). The compliance page states '99,95% monthly uptime' and says the SLA sits in the terms, but the terms read on 6 November state no uptime figure (5 of 10). Generally available (10). 10+5+12+12+5+10 = 54.

Nutrient DWS Processor API 78

Graded with the hosted lines. Status page at www.nutrientstatus.com on Better Stack with a Processor API component and 90 days of daily history (20). The JSON feed read on 1 November 2026 covers 3 August to 1 November. The Processor API was down on five days, the longest 451 seconds on 6 August and the latest 205 seconds on 30 October. DWS Platform was down 45 seconds on 23 August and 154 seconds on 7 September, and the Data Extraction API 1,763 seconds (about 29 minutes) on 1 September. Nothing reaches an hour, so minor only (20). The feed has no component for the hosted MCP server. The pricing guide and the product page FAQ give 100 requests a minute per key on all plans, and 10 a minute for test keys (15). It recommends exponential backoff, async admission returns Retry-After, and Idempotency-Key covers async builds only, so 13 of 15. The product page mentions guaranteed SLAs on custom plans, but no SLA document is published and the terms disclaim availability (0). GA, at spec version 1.20.0 (10). 20+20+15+13+0+10 = 78.

ConvertAPI 25

No x402, MPP or L402 (0). Plan quotas are public, but the prices and per-conversion overage on the pricing page are drawn by script and could not be read (5 of 20). A free trial of 250 conversions with no card, per llms.txt (20). A person signs up in a browser (0). 0+5+20+0 = 25.

Nutrient DWS Processor API 40

No x402, MPP or L402 (0). Plans are public at $75, $275 and $445 a month for 1,000, 5,000 and 10,000 credits, or $67, $247 and $399 a month billed yearly, and the pricing page gives the credit cost of each tool, from 0.5 for HTML to PDF to 10 for a digital signature (20). The free plan gives 50 Processor credits a month with no card and watermarked output, and the MCP page repeats it (20). The OAuth server supports dynamic client registration and a device flow, but a person still signs in or signs up in a browser, and the hosted MCP server needs the same sign-in (0). 0+20+20+0 = 40.

ConvertAPI 55

Tokens per environment with usage limits, JWTs with expiry and IP restriction, a separate Master Token for admin endpoints, OAuth on the hosted MCP (30), less 10 for the documented Token query parameter and its Secret and Auth aliases (20 of 30). Usage limits per token, but no read-only token, and stored files can be deleted (8 of 20). Extracted text and OCR output come from the documents, with no prompt-injection guidance (3 of 15). Usage statistics and per-environment consumption through the Master Token (10 of 15). ISO 27001 certificate linked, SOC 2 Type 2 stated with the report on request, cyber insurance; no disclosure policy, security.txt or bug bounty found (14 of 20). 20+8+3+10+14 = 55.

Nutrient DWS Processor API 68

OAuth at api.nutrient.io with PKCE (S256), dynamic client registration, a revocation endpoint and per-product scopes; the hosted MCP server asks for mcp:invoke and accepts product:processor, product:data_extraction and others. Live keys can be scoped, and POST /tokens issues JWTs limited to named operations and origins, expiring within 24 hours and revocable. The base key can only be regenerated. No query-string credential is documented (28). Scoped keys, operation-limited JWTs and product scopes on OAuth, but no confirmation step. The supported MCP route is now hosted and reads no local paths, so the local server's unrestricted file access without SANDBOX_PATH no longer applies (15, up from 13). Document text comes back as untrusted content, and no prompt-injection guidance was found (4). Each response reports credit cost and remaining credits with a request id, a usage endpoint exists, and extraction runs from the MCP server land in a run history the person can review. No audit log was found (6). SOC 2 Type 2 and SOC 3 per the trust centre, annual penetration testing by Prescient Security, and a vulnerability disclosure policy with a report page, per the 8 October check. security.txt is still a 404 and no bounty was established (15). 28+15+4+6+15 = 68.

ConvertAPI 65

Closed service with terms dated 24 September 2026 naming ConvertAPI, UAB under Lithuanian law (15 of 30). Files are stored at most 3 hours or converted in memory per the compliance page, and a DPA and BAA are published, but llms.txt also says files are 'deleted immediately after processing by default', and the terms give no periods (20 of 30). The changelog dates changes, including the removal of the AiMode parameter on 22 October 2026 with no prior notice found, and the docs mark the secret as deprecated with no date; no deprecation policy (6 of 20). Subprocessors named with roles and regional endpoints listed (18 of 20). 15+20+6+18 = 59.

Nutrient DWS Processor API 76

The API is closed under a dated licence agreement (October 2026) naming PSPDFKit GmbH, and the TypeScript and Python clients are MIT, as is the now unsupported local MCP server, so between the two bands (20). The privacy policy has a Processor API section, the terms carry data processing terms in section 9, and files are deleted within 24 hours on plans without retention. The MCP page says the server keeps nothing, uploads expire after 24 hours, and extraction runs stay in the run history until deleted. Plans with retention enabled let Nutrient keep files and train models on them, and no public page says which plans those are. The October 2026 terms add that free-tier settings apply to Enterprise evaluations unless Nutrient disables retention, and that a paid plan switched to retention needs the customer's acceptance while a free plan needs only advance notice (20). No deprecation policy, and the terms allow changes at any time. The local MCP server's end of support is dated 14 October 2026 in the repository and on npm, with the hosted server named as the replacement, but it took effect the day it was announced (8, up from 4). The trust centre lists 51 sub-processors with locations, updated 8 September 2026, and the status page names Frankfurt and Oregon processing regions, per the 8 October check (18). 20+20+8+18 = 66.

ConvertAPI 92

OpenAPI 3.0.4 at v2.convertapi.com/info/openapi, 333 operations with token, JWT and secret schemes, plus per-conversion documents and wildcard listings (25). A long llms.txt written for agents (10). llms.txt tells agents to discover conversions rather than assume them and explains workflows and storage; converter pages describe each parameter (16 of 20). Per-converter parameter schemas in the OpenAPI document, validated by the MCP convert tool (12 of 15). 25 numbered error codes with meanings and examples throughout (14 of 15). v2 API and a dated public changelog (15). 25+10+16+12+14+15 = 92.

Nutrient DWS Processor API 82

A public OpenAPI 3.1.0 document, now version 1.20.0 per the API reference page, with 17 operations and 203 schemas per the 8 October check of 1.19.0, not re-read on 1 November (25). llms.txt at site and product level with topic indexes, and a Markdown twin of each guide (10). Tag descriptions explain the Build API, async jobs and authorisation at length. The tool descriptions of the hosted MCP server couldn't be read first-hand, since tools/list needs an OAuth token (15, kept from 8 October). 102 of 203 schemas use enums and build actions are discriminated by type, per the 8 October check (13). Guides carry samples in six languages, and the errors guide and async tables document the response bodies (14). The spec is versioned, but the only changelog was the local MCP server's, which stopped with that server on 14 October, and the hosted server 2.0.0 has none. No public API changelog was found, and the move from 1.19.0 to 1.20.0 is undated (5). 25+10+15+13+14+5 = 82.