Gumloop vs Node-RED

Gumloop

Gumloop's REST API has a public OpenAPI file with 105 operations, Markdown docs and a changelog with 28 dated releases since 9 July 2026. API keys need the $37 Pro plan, the trial needs a card, the key can travel in the URL, and self-serve content may be used to train Gumloop's models.

Node-RED

Node-RED's Admin HTTP API covers flows, nodes and settings in 20 documented methods, with read and write permissions per resource and a revision check on deploys. It has no OpenAPI file, no pagination and no SDK, and a default install accepts API calls from anyone who can reach port 1880.

Gumloop

1. Send the key as Authorization: Bearer and, for a personal key, add the x-auth-key header with the user ID. Do not put api_key in the URL
2. Create sessions with POST /agents/{agent_id}/sessions, then poll GET /sessions/{session_id}. A 202 means processing or queued, and the reply is not in the response
3. Supply your own session_id when creating a session. A repeat returns 409, which makes a retry safe
4. For streamed output send the same body with stream: true to ws.gumloop.com. api.gumloop.com answers 400 to it
5. Treat a webhook trigger URL as a password. It returns {"success": true} at once and never carries the agent's output

Node-RED

1. Call GET /auth/login first. An empty object means no authentication is set and every Admin API call is open
2. Send Node-RED-API-Version: v2 and the last rev on POST /flows, and re-read the flows on a 409
3. Set Node-RED-Deployment-Type to nodes or flows to restart only what changed. The default full stops every node
4. Prefer GET /flow/:id and PUT /flow/:id for one tab. GET /flows returns every node in the runtime
5. Treat flows.write and nodes.write as code execution on the host. Function nodes run JavaScript and POST /nodes installs npm modules