Envia vs ShippyPro

Envia 80

Each reference page's Markdown copy embeds an OpenAPI definition with sandbox and production servers (25). llms.txt and a Markdown copy of each page (10). Endpoint descriptions say what each is for and which call comes next in the workflow, and the rate tool warns that sandbox rates are simulated (15 of 20). The quote definition has 17 enums and required lists (11 of 15). Workflow examples and an error-formats guide named in the changelog, though its Markdown address answered 404 and the quote definition documents only 200 (9 of 15). A dated docs changelog by month, the latest March 2026 (10 of 15). 25 + 10 + 15 + 11 + 9 + 10 = 80.

ShippyPro 18

The API reference at api.shippypro.com/docs loads its two OpenAPI files (/docs/v1.json and /docs/v2.json) by script, and neither it, the API product page, llms.txt nor the help centre links them as a visible download. This run counts a spec only where a docs page links it as a download, so the contract line is 0 (from 25) and the 9 October readings taken from the files are withdrawn. www.shippypro.com/llms.txt, which robots.txt now allows, lists marketing pages and one link to the reference, and no Markdown docs were found, so it doesn't meet the line (0). The help centre's API articles say what the API is for, that Ship and Edit calls create real labels while the Generic carrier is for tests, that only successful Ship calls count against the plan, and how field validation can block a call (6 of 20, from 14). No typed parameter reference was found outside the script-loaded files (0, from 9). The API errors article explains Status 1 and 2 and names common error messages with their fixes, and the panel keeps an error history. No request examples were found outside the files (6 of 15, from 10). The reference page names v1 and v2, and no changelog was found (6 of 15). 0+0+6+0+6+6 = 18.

Envia 20

Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

ShippyPro 80

Read with the hosted lines and scored on the v1 REST API, where rates, labels and tracking live. Statuspage at status.shippypro.com, read under its own robots.txt on 4 November, with components for ShippyPro Platform (UI), ShippyPro API & Webhooks and each carrier (20). Its history pages and feed cover the whole 90 days from 6 August, with 122 entries outside scheduled maintenance. Nearly all are one carrier's label creation, marked critical. The others are Orders page problems on 10 August, unsent SMS one-time codes and notifications (29 August to 3 September and 19 September to 5 October), a platform login problem of 3 hours 6 minutes on 18 September, pickup point search for some carriers on 22 October (47 minutes), PDF label retrieval on 22 October and website timeouts for some users on 27 October. None names the API, and each touches one carrier, one function or the web app, so all are partial and read as minor, as on Shippo, ShipStation, Sendcloud and EasyPost (20, from 10, where the 9 October check read the login problem as a major). 20 API calls every 10 seconds, with a 429 above it and a higher limit for a fee, per the help centre re-read on 4 November (15). The help centre documents the 429 with no backoff or Retry-After guidance and suggests spreading calls over several IP addresses. Its API errors article says a Ship call that times out can still create a label, recommends the asynchronous Ship option and names the error for a repeated Transaction ID, which is safe-retry guidance for the core write. The 9 October reading of v2's Retry-After and Idempotency-Key came from files this run doesn't read (see Schema), so the earlier partial is kept on the help centre alone (5). The SLA commits to 99.5 per cent a month with service credits, per the 9 October check, not re-read on 4 November (10). GA (10). 20+20+15+5+10+10 = 80.

Envia 16

Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.

ShippyPro 61

Closed service. The Terms & Conditions, re-read on 4 November, are public and name the contracting entity, but carry no date and reserve the right to change the agreement without notice. No automated-access ban was found (12 of 30). The privacy policy covers shipment sender and recipient data per product area, anonymises Amazon customer data 30 days after delivery, keeps staff impersonation logs for 19 months and says personal data is never sold. General retention is stated only as long as necessary, and no DPA was found, per the 9 October check (18 of 30). No deprecation policy. The terms allow any service to be discontinued without notice. The status page carries dated carrier notices, among them the FedEx SOAP API deprecation notice (posted 30 March, closed 22 October 2026) and Deutsche Post (17 August), and the SLA promises seven days' notice of planned downtime (6 of 20). Sub-processors are named per product area, and the full list with countries is a PDF whose file name is dated 15 September 2022, which we did not read (12 of 20). 12+18+6+12 = 48.

Envia 53

Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.

ShippyPro 19

Scored on the REST API from the help centre, since the OpenAPI files aren't read. No response sizing or field selection (0 of 25, from 12) and no pagination or filtering (0 of 20, from 10) is documented outside the files. Label failures return Status 2 with an error message, and the errors article gives causes and fixes for common errors, with an error history in the panel (12 of 20, kept). No idempotency key is documented outside the files, but a repeated Transaction ID is refused with a pointer to the Edit call, and Ship can run asynchronously so a timeout doesn't leave its result unknown (7 of 20, kept). No official SDK was found, though the API page's FAQ mentions SDKs, and required parameters can't be read outside the files (0 of 15, from 5). 0+0+12+7+0 = 19.

Envia 20

No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.

ShippyPro 5

No x402, MPP or L402 (0). The pricing page, re-read on 4 November, lists full access to the Multicarrier APIs only on the Enterprise plan at a custom price through sales, and marks Professional (159 EUR a month) as Multicarrier API Access not included (0). The terms describe a 14-day, 30-order trial with no card. The help centre now says to check that the subscription includes API access, so we could not establish that a trial account can call the API, and give part credit (5 of 20). A person signs up in a browser and sales activates the API (0). 0+0+5+0 = 5.

Envia 35

Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.

ShippyPro 48

API keys are created in the panel, several per account, in three types (Full Access, Maps, PII Excluded), per the help centre re-read on 4 November. No expiry or rotation was found, and the 9 October reading of a 401 for a revoked key came from the unread v2 file, so the earlier partial is kept (22 of 30). The Maps and PII Excluded types narrow a key, but there is no read-only key and no confirmation step for label creation or voiding. The Generic carrier allows tests without a real shipment (8 of 20). Tracking messages and marketplace order text come from third parties, and no guidance on untrusted content was found. The errors article says requests are screened for script-like strings (3 of 15). The panel has API logs with requests and responses, an API error history and webhook logs (10 of 15). llms.txt and the site footer state SOC 2 Type II and ISO 27001, with no certificate, report, trust page or disclosure route found, and robots.txt still disallows /.well-known/security.txt. This run scores a certification claim with no report or disclosure route 5 (from 8). 22+8+3+10+5 = 48.