Hygraph vs Kontent.ai

Hygraph

Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.

Kontent.ai

Management API keys take per-area permissions, environment limits and an expiry from one minute to two years, and changes made with a key are named in the audit log. Rate limits and Retry-After are documented. No price is published, and no OpenAPI file was found. Access starts with a 30-day trial that a person opens in a browser.

Hygraph

1. Send the Permanent Auth Token as Authorization: Bearer <token> to https://<region>.hygraph.com/v2/<projectId>/<environment>. Read the schema by introspection first, because every type is generated from the project's models
2. Mutations write to DRAFT. Call publish<Model> with to: [PUBLISHED] as a separate mutation, and pass locales to write or publish a localisation
3. Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429
4. Upload an asset with createAsset, then POST the file to the returned pre-signed URL, or pass uploadUrl for a remote file. The asset stays ASSET_CREATE_PENDING until processed
5. Schema changes go to the Management API through @hygraph/management-sdk or the MCP tool submit_batch_migration. Version restore has no documented mutation, so read <model>Version and write the old values back

Kontent.ai

1. Send Authorization: Bearer <key> to https://manage.kontent.ai/v2/projects/{environment_id}/.... The Management API must be switched on under Environment settings, General, Enabled APIs first
2. Ask for a Management API key with only the permissions the task needs. Read content alone gives a read-only key, and keys expire after six months by default
3. Stay under 10 requests a second and 400 a minute per environment, send requests one at a time, and wait the seconds in Retry-After on a 429
4. Page lists by passing the continuation_token from the response back in the x-continuation header
5. Create items with an external_id and write with the upsert PUT at /items/external-id/{id} so a retry after a lost response does not create a duplicate
6. With the MCP server, call get-patch-guide before any patch tool, and use a client that prompts on destructiveHint