GPT-Live vs Inworld Realtime API

GPT-Live 87

The OpenAPI 3.1 file in openai/openai-openapi (re-read from a clone at its 31 October commit) has seven /live/sessions paths and 190 component schemas whose names start with Live by our count, up from the 17 October file with the 24 October revision of Decisions inputs and the 28 October DTMF command, and typed client and server events on the primary and sideband connections. It is not an AsyncAPI document, so the WebSocket channels are described only as event schemas (22 of 25). llms.txt and a Markdown twin of every page (10). The delegation guide has a table of when to choose Responses or client delegation, the connection guides say when to use WebRTC, WebSocket or SIP, and the Decisions guide says when to delegate or react to transcripts (17 of 20). Fields carry enums and limits, such as delegation.type, SIP reject codes 300 to 699 and 500-token appends, but model also accepts any string and the Live MCP tool schema types only type (12 of 15). Python and JavaScript examples on every guide, an error event with a documented shape and several named codes, and a table of close reasons. No full catalogue of Live error codes was found, and three JavaScript examples in the Markdown twins are empty (12 of 15). A dated changelog tags entries with v1/live/sessions, there is one snapshot, and the deprecated webhook event is named (14 of 15).

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

GPT-Live 90

Closed service. The Python SDK is Apache-2.0, and the OpenAPI file and the Live Console sample are MIT. The services agreement is scored as the OpenAI API listing scores it, per that listing's check, since openai.com answered our reader with 403 (15 of 30, was 10, the reading every other OpenAI listing carries). The data controls page, re-read on 1 November, says /v1/live/sessions data is not used for training, abuse logs are kept up to 30 days, recordings are stored for 30 days only when store is true and storage is enabled, and Zero Data Retention treats store as false. It also says there is no public endpoint to delete a stored session. Those are stated conditions, not statements that disagree. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 1 November (openai.com answered 403). The same reading as the other OpenAI listings (30 of 30, was 18). The deprecations page states at least six months' notice for generally available models and lists dated shutdowns (20 of 20). The data-controls guide lists /v1/live/sessions for storage and processing in the United States and Europe only, narrower than most OpenAI endpoints, and the subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries and a notice form, per the OpenAI API listing's 4 October check. Locations and subprocessors are disclosed, which is what the line scores (20 of 20, was 10). 15 + 30 + 20 + 20 = 85.

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

GPT-Live 81

The project API key is sent as a Bearer header from a server, and WebSocket connections take no query parameters. GPT-Live has no browser client secret, so the key never reaches a browser and the server creates each session. Project keys carry their own permissions, service-account keys come through the Administration API, and the docs index lists workload identity federation, mutual TLS and IP allowlists. The access-control guide, re-read on 1 November, has no permission of its own for /v1/live/sessions, so a restricted key can't be confirmed to reach Live alone, the reading the OpenAI Decisions API and speech-to-text listings got (27 of 30, was 24). The WebRTC data channel can be limited to listed client and server events for an untrusted frontend, though the default allows all. The application runs custom functions and answers MCP approval requests (15 of 20). The guardrails guide describes checking input transcripts for jailbreak attempts and blocking actions until checks pass, the SIP guide says to treat SIP headers as untrusted, and the session guide says to keep trusted instructions apart from user messages and results. No guidance on injected content in hosted tool results was found (9 of 15). Usage events per session, a final session snapshot, optional stored recordings and Admin APIs with audit log retrieval. The OpenAPI file has no /organization/usage/ endpoint for Live sessions, so the per-key usage view other OpenAI listings get 15 for isn't there (10 of 15). security.txt, re-read on 1 November, is PGP-signed with a Bugcrowd bug bounty and a coordinated disclosure policy and has no Expires field, and trust.openai.com names SOC 2 Type 2 and ISO/IEC 27001, per the OpenAI speech-to-text listing's 1 November read. The bounty and disclosure policy carry the line, as on the other OpenAI listings (20 of 20, was 8). 27 + 15 + 9 + 10 + 20 = 81.

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

GPT-Live 20

No x402, MPP or L402 in the docs or the OpenAPI file (0 of 40). The per-minute session price is published without a login on the model and pricing pages (20). The model page lists the Free usage tier as unsupported for gpt-live-1 (0). API keys are created in the platform after a browser sign-in (0).

Inworld Realtime API 40

No x402, MPP or L402 (0). No per-session price, but each billed part (STT per hour, TTS per character, LLM per token) is priced publicly (20). On-Demand includes free STT and TTS allowances and lists no payment method, though some premium LLMs need a card on file (20). A person signs up in a browser before a key exists (0). Total 40.

GPT-Live 82

The last dated changelog entry tagged v1/live/sessions is still 16 October 2026, and the Live contract changed again after it, with the Decisions inputs revised on 24 October and a SIP DTMF command added on 28 October in the OpenAPI file, shipped in the Python SDK 3.42.0 on 31 October (30). Three changelog entries in the last 90 days, on 10 September, 15 October and 16 October (20). Closed service with a changelog updated several times a week and a community forum and Discord linked from the docs, which we did not test (10 of 15). Current official SDKs, with openai for Python at 3.42.0 on 31 October 2026 and Live changes in several releases since 10 September (15). The SDK is Apache-2.0 and released often. Its CI results were not read (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

GPT-Live 76

Scored as a model API. Context is managed by the service in a 128,000-token window with background summaries, startup history is capped at 128 messages and 8,192 tokens, and session.usage.updated reports a context usage_ratio. The client cannot set its own truncation (20 of 25). There are no lists to page. The WebRTC frontend can be restricted to listed server events, transcripts are optional, and backend max_output_tokens is configurable (12 of 20). Errors carry code, param and the client_event_id of the failed command, configuration errors have their own code, and session.closed gives a reason (17 of 20). Commands are matched to acknowledgements by event_id, the sideband replays 3 seconds with original event IDs, and stored sessions can be forked to resume after a drop. Session creation has no idempotency key and outbound calls must not be retried (12 of 20). Only model is required, the voice defaults to marin, and the openai SDKs for Python and Node.js have Live resources, with partner integrations for LiveKit and Pipecat (15).

Inworld Realtime API 68

Scored as an API. Conversation history defaults to the last 100 items, can be trimmed, and can be cached on Anthropic models, and every response.done carries a usage block (18 of 25). No lists to page. Output controls are modalities, turn detection settings, optional transcription and response.speak (12 of 20). Error events follow OpenAI's type and code shape, unsupported fields come back as non-fatal unsupported_field warnings, and item_not_found names the bad parameter (14 of 20). Tools run on the client and a follow-up response starts automatically after a tool result. Nothing covers side effects of a tool call cut off by an interruption (12 of 20). Works with OpenAI Realtime clients after changing the URL and key, with no Inworld Realtime SDK (12 of 15). Total 68.