Cronofy API vs YouCanBookMe API

Cronofy API 95

Atlassian Statuspage at status.cronofy.com with the API, Scheduler, Meeting Agents and each calendar provider as components (20). history.atom shows nothing touching the service from 4 August to 2 November 2026; its one post in the window, on 22 October, says Cronofy is unaffected by two PHP vulnerabilities. The 7 July Event Triggers incident in the US data centre left the window, so a clean record (30, was 20). 50 requests a second and 500 in any 60 seconds by default (15). 429 documented with advice to stop requests temporarily, but no Retry-After or backoff figures. Event writes are upserts keyed on your event_id, so a repeat updates rather than duplicates (10). 99.99% uptime guarantee on Emerging and Growth, and an API SLA policy page (10). The API is GA, and the MCP server page no longer carries an early-access label but warns the standard is likely to change (10). 20+30+15+10+10+10 = 95.

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Cronofy API 76

API responses can be narrowed, for example Availability's response_format of slots and the only_managed flag on events (15). Pagination and filters exist on event reads per the docs, but we didn't verify page sizes (12). Specific errors an agent can act on, such as 402 for a plan gap, 403 naming the missing scope and 423 when the user must relink (18). Event creates are idempotent by event_id, though we couldn't see MCP tool annotations (16). Official SDKs in Node, Python, Ruby, C# and more (15).

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Cronofy API 58

No OpenAPI or other machine-readable contract found (0). llms.txt with about 35 to 40 links and Markdown copies of pages (10). Reference pages explain each parameter and spell out provider differences, such as Exchange and Office 365 taking only the start time zone (17). Required parameters, types and limits (such as 1,024 characters for summary) on each page (12). Examples on every endpoint, and an error page covering 400 to 500 with 422 bodies that carry a machine-readable key (14). /v1 in the path. The changelog at changelog.cronofy.com is on a host whose robots.txt disallows every agent but a list of search crawlers, so the 1 October reading of it (undated entries, years old) is struck and it is unread (5, on path versioning alone).

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Cronofy API 71

Cronofy's UI Elements, the JavaScript components it publishes for its API, carry a dated changelog in the docs with three code releases in October 2026, 1.68.0 (15 October, Romanian language support), 1.68.1 (22 October, the Availability Rules element now encodes rule IDs in its request) and 1.68.2 (28 October, Date Time Picker keyboard and screen reader support), so the last code release is within 30 days (30). pycronofy 2.1.2 (30 October) and 2.1.1 (25 September) change only packaging, 2.1.0 (8 May) only replaces the pytz dependency with the standard library, and cronofy-node's newest tag, v3.8.4 (15 September 2025), bumps axios. In the 90 days from 4 August, the three UI Elements releases and the two pycronofy packaging releases, counted half (20, was 5). Support through the docs, support pages and support@cronofy.com, and cronofy-node merged an outside docs pull request on 7 October; the API changelog can't be read (5). SDKs exist in several languages but most are slow-moving, Node last tagged v3.8.4 on 15 September 2025 and Ruby last tagged in 2023 (8). CI on the Node and Python SDKs, with Python 3.15 added on 30 October 2026 (8). 30+20+5+8+8 = 71.

YouCanBookMe API 28

Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.

Cronofy API 60

Per-user OAuth with fine scopes, including free_busy alone, read_only, and delete_event separate from create_event. Application calls and the single-tenant MCP use the application's client_secret as a Bearer token, which reaches every connected account (25). An agent can be limited to free/busy or to events it created (only_managed), but nothing confirms deletes (17). Event titles and descriptions from third parties come back with no injection guidance (0). No operator audit log found (0). ISO 27001, 27018 and 27701, SOC 2 Type 2 and a public bug bounty policy. No security.txt, per the 30 September check (18).

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Cronofy API 72

Closed service with terms naming Cronofy Limited (company 07878590) under English law, and MIT-licensed SDKs (15). The data management policy gives numbers. Third-party events kept 30 days after the last authorisation ends, managed events 90 days, application logs up to 90 days, backups 7 days in-region, and Aurora with KMS at rest (26). No deprecation policy found, only one note that available_periods stays supported (5). Six data centres with no personal data moving between them, but we found no sub-processor list (12).

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.