Inworld Realtime API vs Ultravox Realtime API

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

Ultravox Realtime API 84

OpenAPI schema at api.ultravox.ai/api/schema/ (25). llms.txt with Markdown copies (10). Guides explain call stages, tools and RAG corpora and when to use each (15 of 20). The OpenAPI types call creation with enums and required fields (13 of 15). Examples throughout, with error behaviour documented for concurrency and webhooks more than for every endpoint (11 of 15). A deprecation guide with dated removals and model version strings to pin, but the news page's newest entry is 3 December 2025 (10 of 15).

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

Ultravox Realtime API 53

The deprecation guide added a dated entry on 3 November 2026 for priorCallId inheriting call fields, deprecated that day and removed on 7 December 2026, with a migration link to the making-calls guide. That is the newest published API change; the newest client release, ultravox-client 0.6.0 (tag 17 July, npm 18 July 2026), is 109 days old (30; was 20). Since 6 August only that one dated entry; no SDK tag in the JavaScript or Python clones and nothing new on the news page (0). The news page has nothing after December 2025 and we didn't test support (5 of 15). Client SDKs for six platforms. JavaScript 0.6.0 is the newest, the Python client's last release is 0.1.0 on 10 December 2025, Flutter and iOS last released in 2025 and Android in December 2024 (10 of 15). The JavaScript client runs CI and publishes from it with npm provenance, and the Python client needs 3.10 or later (8 of 10). 30 + 0 + 5 + 10 + 8 = 53.

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

Ultravox Realtime API 46

Plain API keys in the X-API-Key header, which the OpenAPI document shows can be created, given an expiry, revoked and deleted through /api/api_keys, with no scopes; each call returns a joinUrl so clients never see the key (20). We found no scoped or read-only keys (8 of 20). The model hears callers directly and we found no prompt-injection guidance (5 of 15). Call records and a delete-call API, but no audit log (8 of 15). No security.txt (www.ultravox.ai answers 404). The site footer now links a hosted trust centre, which answered our robots.txt request with a Vercel bot check, so its contents are unchecked. Webhook signing is documented (5 of 20). 20 + 8 + 5 + 8 + 5 = 46.

Inworld Realtime API 62

Hosted reading of the checklist. status.inworld.ai is a public status page (20), with history we couldn't read, as on inworld-tts (5). Concurrent sessions are published per plan, 10 on On-Demand up to 1,000 on Growth (15). The rate limits page gives exponential backoff with jitter and Retry-After on longer windows, and sessions emit rate_limits.updated, with nothing on reconnecting a dropped session (12 of 15). An SLA appears only in the Enterprise column, with no terms (0). No preview or beta label on the Realtime API (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.

Ultravox Realtime API 52

A status page sits at status.ultravox.ai, but its robots.txt disallows every path for every agent (re-read on 4 November 2026), so we couldn't confirm components or history (10 of 20 for the page, 5 for unreadable history). Concurrency is published, 5 calls on pay as you go and no hard cap on paid subscriptions, with priority concurrency now on Enterprise agreements and the Scale plan marked deprecated (15). Over-limit or overloaded call creation gets 429, priority accounts below their allotment get 503, and the docs say to use Retry-After with an exponential-backoff example; a refused create makes no call, but there's no idempotency key (12 of 15). No SLA found; Enterprise lists a response SLA only (0). The Realtime API is generally available (10). 10 + 5 + 15 + 12 + 0 + 10 = 52.

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

Ultravox Realtime API 71

The Ultravox model code is MIT on GitHub, and the v0.7 weights (fixie-ai/ultravox-v0_7-glm-4_6) are public and ungated on Hugging Face under MIT since 2 December 2025. The hosted service is closed (26 of 30). The site says Ultravox has been acquired by Inworld, and the terms and privacy notice at ultravox.ai are now Inworld AI's, both effective 1 October 2026. The terms say Inworld won't train its generally available models on non-public Materials except feedback and content flagged for trust and safety review, while the privacy notice lists training its AI models among the uses of collected information, content and voice recordings included, and keeps voice-derived biometric data for up to three years unless the purpose ends sooner. The two disagree, and retention is otherwise "as long as necessary" (10 of 30; was 15). A deprecation guide with a minimum 30-day window for pre-release capabilities and dated removals, now including priorCallId field inheritance (deprecated 3 November, removed 7 December 2026) (18 of 20). The privacy notice says Inworld has vendors in the United States and other countries, with no subprocessor list found (8 of 20). 26 + 10 + 18 + 8 = 62.