ConvertAPI vs PDFMonkey

ConvertAPI 92

OpenAPI 3.0.4 at v2.convertapi.com/info/openapi, 333 operations with token, JWT and secret schemes, plus per-conversion documents and wildcard listings (25). A long llms.txt written for agents (10). llms.txt tells agents to discover conversions rather than assume them and explains workflows and storage; converter pages describe each parameter (16 of 20). Per-converter parameter schemas in the OpenAPI document, validated by the MCP convert tool (12 of 15). 25 numbered error codes with meanings and examples throughout (14 of 15). v2 API and a dated public changelog (15). 25+10+16+12+14+15 = 92.

PDFMonkey 61

No OpenAPI document was found on pdfmonkey.io, in llms-full.txt or in the repositories; the 11 MCP tools carry JSON Schema inputs from src/tools.ts (12). llms.txt and llms-full.txt, and every docs page has a Markdown twin (10). MCP tool descriptions are one line each and say what the tool does, and the MCP docs say what the server can't do (create or edit templates) and send that job to the CLI; the API docs explain async against sync and when to use each (12). Parameter tables give types and required fields, list_documents has a status enum, and payload is by nature a free JSON object matched to the template (10). Request examples in curl, Ruby, Node.js, Python and PHP on every endpoint, a 401 body, a 422 body with field names and a troubleshooting section for blank documents, empty and 403 download URLs (12). The API lives under /api/v1 and docs pages carry a last-updated date, but there is no changelog page, changes are announced in blog posts such as What We Shipped Since the Summer of 26 October 2026 (5). 12 + 10 + 12 + 10 + 12 + 5 = 61.

ConvertAPI 55

Tokens per environment with usage limits, JWTs with expiry and IP restriction, a separate Master Token for admin endpoints, OAuth on the hosted MCP (30), less 10 for the documented Token query parameter and its Secret and Auth aliases (20 of 30). Usage limits per token, but no read-only token, and stored files can be deleted (8 of 20). Extracted text and OCR output come from the documents, with no prompt-injection guidance (3 of 15). Usage statistics and per-environment consumption through the Master Token (10 of 15). ISO 27001 certificate linked, SOC 2 Type 2 stated with the report on request, cyber insurance; no disclosure policy, security.txt or bug bounty found (14 of 20). 20+8+3+10+14 = 55.

PDFMonkey 36

One secret key per account with the whole account's privileges, sent as a Bearer header; it can be rotated with a 2-day overlap and the old key revoked at once, but there are no scopes, no second key and no read-only key (12). No least-privilege mode; the MCP server exposes delete_document, the CLI asks before deletions unless -y, and the MCP docs say most clients ask before running a delete (6). The tools return the account's own templates, documents and quota, not third-party content (10). Each document carries generation logs and the dashboard shows usage, but no audit log or per-key activity view was found (3). No security.txt (404), no disclosure policy and no bug bounty; the compliance page says there is no SOC 2 or ISO 27001, and sets against that EU hosting, encrypted payloads and a DPA dated 15 October 2026 (5). 12 + 6 + 10 + 3 + 5 = 36.

ConvertAPI 25

No x402, MPP or L402 (0). Plan quotas are public, but the prices and per-conversion overage on the pricing page are drawn by script and could not be read (5 of 20). A free trial of 250 conversions with no card, per llms.txt (20). A person signs up in a browser (0). 0+5+20+0 = 25.

PDFMonkey 40

No x402, MPP or L402 (0). Plan prices in euros, per-document pay-as-you-go rates and the Boost Pack price are on the public pricing page and in the docs (20). A Free plan of 20 documents a month and a 30-day Pro trial of 300 documents, no card (20). Signup is a browser flow and the key is minted in the dashboard (0). 0 + 20 + 20 + 0 = 40.

ConvertAPI 65

Closed service with terms dated 24 September 2026 naming ConvertAPI, UAB under Lithuanian law (15 of 30). Files are stored at most 3 hours or converted in memory per the compliance page, and a DPA and BAA are published, but llms.txt also says files are 'deleted immediately after processing by default', and the terms give no periods (20 of 30). The changelog dates changes, including the removal of the AiMode parameter on 22 October 2026 with no prior notice found, and the docs mark the secret as deprecated with no date; no deprecation policy (6 of 20). Subprocessors named with roles and regional endpoints listed (18 of 20). 15+20+6+18 = 59.

PDFMonkey 78

Closed service with iubenda terms that name the owner only as PDFMonkey at a Paris address, while the MCP server, CLI, Node SDK and Ruby gem are MIT (20). Retention statements agree across the plans page, the retention page and the data storage page (per-template TTL, 1 day, 7 days or unlimited by plan), the DPA and DsPA of 15 October 2026 are downloadable, and the privacy policy of 16 September 2026 names its processors, though it still lists Heroku where the docs name Fly.io (24). Engine deprecations were announced with a promised heads-up in 2023 and key rotation has a 2-day overlap, but there is no written deprecation policy with notice periods (8). Data locations are named (Paris and Frankfurt) and the DPA carries the approved sub-processor list (18). 20 + 24 + 8 + 18 = 70.

ConvertAPI 54

Hosted lines. status.convertapi.com is a Checkly dashboard drawn by script, so its components were not confirmed (10 of 20) and no history could be read (5). Concurrency per plan is published (1 to 4 concurrent conversions), with no request-rate figure (12 of 15). Under load the API answers 503 and llms.txt gives a 5, 10 and 15 second retry pattern; no 429, Retry-After or idempotency key (12 of 15). The compliance page states '99,95% monthly uptime' and says the SLA sits in the terms, but the terms read on 6 November state no uptime figure (5 of 10). Generally available (10). 10+5+12+12+5+10 = 54.

PDFMonkey 60

Read with the hosted lines. status.pdfmonkey.io is an updown.io page with six checks (API, dashboard, preview, website, generation latency, queue size) and one month of rolling uptime per check, but no incident write-ups (15). The readable record is the uptime figures (API 99.98 per cent and queue 99.97 per cent since 3 October 2026) and the one incident the vendor wrote up, a slowdown of a little under an hour on 29 September 2026 with a post-mortem on 1 October; the 90-day list itself isn't published, so minor incidents only (20). The docs say there is no hard rate limit, only the monthly quota, so no request-rate numbers (5 for the quota numbers). The Node.js SDK retries 408, 429 and 5xx with backoff and honours Retry-After, and the webhook docs say delivery is at least once and to make handlers idempotent, but document creation has no idempotency key (10). No SLA found in the terms or pricing (0). GA (10). 15 + 20 + 5 + 10 + 0 + 10 = 60.