Hume EVI (Empathic Voice Interface) vs Inworld Realtime API

Hume EVI (Empathic Voice Interface) 35

Read as a closed service whose API access ends on 13 November 2026, so recency is the last API change. The SDK releases since June don't change EVI. TypeScript SDK 0.16.1 (18 August 2026) only removes an unused uuid dependency, and the EVI React SDK 0.3.0-beta.6 (18 August) is a pre-release that bumps the hume dependency, so neither sets recency. The last releases that changed EVI code are TypeScript SDK 0.16.0 and Python SDK v0.14.0 on 17 June 2026, regenerations that touched the EVI types (140 days, 10). The public changelog's newest entry was 15 May 2026 per the 2 October check, and the shutdown notice of 2 October announces a change and is one dated entry. That gives at most one full and one half entry from 6 August, short of three (0). A public changelog and no support test (5 of 15 for a closed service). Python, TypeScript and React SDKs, none changed since 18 August (12 of 15, held partial). MIT SDKs with ci.yml workflows in all three repositories (8 of 10). 10 + 0 + 5 + 12 + 8 = 35.

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

Hume EVI (Empathic Voice Interface) 27

One API key and secret key pair per account, replaced as a whole with 'Regenerate keys', plus 30-minute access tokens from a client-credentials endpoint (15). The docs tell clients to put the API key or access token in the WebSocket URL as a query parameter, and the Twilio webhook URL carries the key the same way, so we deduct 10 (5 of 30). No scoped or read-only keys (3 of 20). EVI listens to callers and we found no prompt-injection guidance (5 of 15). Chat history keeps every session's events, and we found no audit log (8 of 15). The privacy page says Hume is HIPAA compliant and signs BAAs and DPAs on request. No security.txt, SOC 2 report or bug bounty found (6 of 20). Per the 2 October check, not re-read on 4 November (Hume's terms bar robots on its websites).

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

Hume EVI (Empathic Voice Interface) 90

llms.txt links an AsyncAPI 2.6.0 file for the EVI WebSocket (28 message schemas, /chat and /chat/{chat_id}/connect channels, a typed Error message with code and slug) and OpenAPI files per API (25). llms.txt (10). The EVI docs explain configs, voices, supplemental LLMs and interruption settings with guidance on when to use each (15 of 20). Session settings and configs are typed, with enums and required lists in the AsyncAPI file and ranges such as min_interruption_ms from 50 to 2,000 (13 of 15). Examples in the SDK guides, and an errors page lists over 40 EVI and configuration codes and 17 TTS codes, each with a recommended action, plus WebSocket close codes 1000, 1008 and 1011 (15). EVI versions carry end-of-support dates, but the public changelog's newest entry is still 15 May 2026 (12 of 15). Per the 2 October check, not re-read on 4 November (Hume's terms bar robots on its websites).

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

Hume EVI (Empathic Voice Interface) 55

Hume's Terms of Service (last updated 5 October 2026) bar access to any portion of the Service, which includes its websites, through spiders, robots, crawlers or data mining tools, so no hume.ai page, status.hume.ai included, was re-read on 4 November. Readings are per the 1 and 2 October checks. A status page at status.hume.ai with component history back to September 2025 (20). Today's window runs from 6 August. Its readable part, 6 August to 2 October, holds one incident, TTS down for about 7 minutes on 19 September, which names TTS and not EVI. The EVI outages of 11 July (about 6.5 hours) and 24 July (about 2.6 hours) are now outside the window, and 3 October to 4 November is unread. A window that is partly unread holds at its recorded award and isn't credited for the unread stretch, as mailtrap's was after its majors aged out, so the line stays at 5 until the rest of the window can be read (5). Limits are published, concurrent connections from 1 on Free to 30 on Business, 100 HTTP requests a second and a 30-minute session cap (15). The error catalogue has a rate-limit code (E0811, 'Retry later') and a too-many-chats code (E0700) that states the active count and limit, but no HTTP 429, Retry-After or backoff guidance (5 of 15, held partial). No SLA found (0). EVI 3 is the generally available default per the 30 September check (10). 20 + 5 + 15 + 5 + 0 + 10 = 55.

Inworld Realtime API 62

Hosted reading of the checklist. status.inworld.ai is a public status page (20), with history we couldn't read, as on inworld-tts (5). Concurrent sessions are published per plan, 10 on On-Demand up to 1,000 on Growth (15). The rate limits page gives exponential backoff with jitter and Retry-After on longer windows, and sessions emit rate_limits.updated, with nothing on reconnecting a dropped session (12 of 15). An SLA appears only in the Enterprise column, with no terms (0). No preview or beta label on the Realtime API (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.