FreeScout vs Gladly

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Gladly 84

Public OpenAPI 3.0.1 file with 87 operations, split across linked files (25). llms.txt and a 91 KB llms-full.txt on developer.gladly.com (10). Operation and resource descriptions state purpose and caveats, such as items created by API being non-routable and the Tasks API replacing task calls on conversations, with little on when not to use a call (13 of 20). Request schemas carry required fields and enums, 39 enum lists in the conversations file alone, and typed examples (12 of 15). Request examples and per-operation error responses with sample bodies, though the plain-text reference leaves out request body fields (12 of 15). Versioning by URL path with a written policy on compatible changes, and weekly release notes with entries tagged for developers. There is no API-only changelog (12 of 15). Per the 8 October check, not re-read on 4 November, because Gladly's terms bar scraping its websites.

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Gladly 59

Closed service. The public Terms of Service cover the services and APIs but are dated 21 June 2016, and customers sign a separate Services Agreement that isn't public (12 of 30). The privacy policy of 1 December 2024 says customer-submitted data is processed on the customer's behalf, and the help centre documents retention (indefinite by default, or deletion after 365 days or more). The security page says there is no model training on customer data, while the terms grant Gladly a licence to use submitted content to improve the service and to use aggregated, anonymised data for any purpose. No public DPA found (14 of 30). The versioning policy promises ample advance notice before a version is removed, with no period stated (8 of 20). No sub-processor list or data location found on the public pages, and the trust centre could not be read (0 of 20). Per the 8 October check, not re-read on 4 November, because Gladly's terms bar scraping its websites.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Gladly 43

Basic auth with a user's email and an API token. Several tokens per user, shown once, deletable, with a documented rotation procedure, and never sent in a URL. The reference says a token can make any API request without restriction, so no scopes (20 of 30). No read-only token and no confirmation step for deleting a customer profile, which can't be undone. A dedicated API user and a separate sandbox on gladly.qa are the only limits found (5 of 20). The API returns customer-written messages and no prompt-injection guidance was found (0 of 15). An Audit Log report covers configuration changes, and webhook logs keep the last 100 requests. No per-call API log found (8 of 15). SOC 2 Type II, PCI DSS, HIPAA and annual penetration tests per the security page, and a trust centre on Vanta that we could not read. No security.txt, disclosure policy or bug bounty found (10 of 20). Per the 8 October check, not re-read on 4 November, because Gladly's terms bar scraping its websites.

FreeScout 50

Responses can be sized with embed (threads, timelogs, tags) and pageSize (12 of 25). Page and pageSize paging, with conversation filters by mailbox, folder, status, state, type, assignee, customer email and phone (16 of 20). Errors return a status code, an errorCode and a list of messages, with each code explained (14 of 20). The docs say a timed-out call is safe to retry; no idempotency keys for creates (3 of 20). No official SDK; few required parameters on most calls (5 of 15). 12 + 16 + 14 + 3 + 5 = 50.

Gladly 42

Responses can't be sized. No field selection or page size, and lists stop at fixed caps (8 of 25). Lists are not paginated, with a Gladly-Limited-Data header when rows are cut off. Customer search takes one of email, phone number or external id, and events take a time range and entity types (6 of 20). 400 errors carry attr, code and detail, 409 names the conflict, and merged records return the surviving id in meta.new (17 of 20). No idempotency key. Creating an item with an id already in use returns 409, and adding a topic already present is ignored (6 of 20). Few required parameters, but no REST client library in any language, only JavaScript samples (5 of 15). Per the 8 October check, not re-read on 4 November, because Gladly's terms bar scraping its websites.