Inworld Realtime API vs Vocily AI

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

Vocily AI 90

A public OpenAPI 3.1 file, linked from llms.txt, with 60 operations on 4 November (54 on 8 October) at docs.vocily.ai/developers/openapi.json (25). llms.txt, llms-full.txt and a Markdown copy of every page (10). Pages say what each route is for and what to use instead, such as webhooks over polling and dashboard batches over a loop of calls, though some operation titles are generated names such as Create Kb (16 of 20). Bodies refuse unknown fields and carry ranges and enums, but list filters such as status are plain strings and variables and metadata are free-form (12 of 15). 234 example entries in the spec, a reason-code table by status and a 422 that lists every invalid field (15). The /v1 prefix and a dated API changes page from 23 September 2026, which records removals made under /v1 (23 and 25 September, 10 and 30 October) against the reference's own rule that fields are never removed within a version (12 of 15). 25 + 10 + 16 + 12 + 15 + 12 = 90.

Inworld Realtime API 62

Hosted reading of the checklist. status.inworld.ai is a public status page (20), with history we couldn't read, as on inworld-tts (5). Concurrent sessions are published per plan, 10 on On-Demand up to 1,000 on Growth (15). The rate limits page gives exponential backoff with jitter and Retry-After on longer windows, and sessions emit rate_limits.updated, with nothing on reconnecting a dropped session (12 of 15). An SLA appears only in the Enterprise column, with no terms (0). No preview or beta label on the Realtime API (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.

Vocily AI 40

Graded on the public REST API at api.vocily.ai, read as a hosted service. No status page found: status.vocily.ai gave no answer on 4 November and neither the site nor the docs link one (0). No readable incident history (5). The limit is published as 300 requests a minute per key (moving window), with ten concurrent calls per organisation included (15). A 429 carries Retry-After and X-RateLimit headers, and POST /v1/calls, the write that places a billed call, requires an Idempotency-Key and returns the original call on a retry (15). No SLA found. The terms say availability isn't guaranteed (0). The docs don't label the API beta, but nine dated changes from 23 September to 30 October 2026 changed the /v1 contract, seven of them with removals, changed error codes or changed meanings, and the terms still allow for beta and pre-launch service; the 8 October reading of the API root's version is struck (a request to the product's own endpoint), and the partial is carried (5 of 10). 0 + 5 + 15 + 15 + 0 + 5 = 40.

Inworld Realtime API 68

Scored as an API. Conversation history defaults to the last 100 items, can be trimmed, and can be cached on Anthropic models, and every response.done carries a usage block (18 of 25). No lists to page. Output controls are modalities, turn detection settings, optional transcription and response.speak (12 of 20). Error events follow OpenAI's type and code shape, unsupported fields come back as non-fatal unsupported_field warnings, and item_not_found names the bad parameter (14 of 20). Tools run on the client and a follow-up response starts automatically after a tool result. Nothing covers side effects of a tool call cut off by an interruption (12 of 20). Works with OpenAI Realtime clients after changing the URL and key, with no Inworld Realtime SDK (12 of 15). Total 68.

Vocily AI 84

List calls take limit from 1 to 100, default 20, and return the transcript only with include=transcript (20 of 25). Every growing list uses the same cursor envelope, and calls filter by agent, status, direction, origin and date. The bounded lists return bare arrays (18 of 20). Errors carry a machine-readable detail.code, a field path on validation failures and an X-Request-ID (20). Idempotency-Key is required on call creation, agent edits accept If-Match on a document revision, and the bulk memory erase previews unless dry_run is false. Other writes have no idempotency key (18 of 20). A call needs only agent_id and to_number and an agent only name. No SDK was found in the docs, on npm or on PyPI (8 of 15). 20 + 18 + 20 + 18 + 8 = 84.

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

Vocily AI 48

A closed service. The terms (10 June 2026) name no legal entity or governing law, still describe a possible beta, and say paid plans may come later while prices are live (10 of 30). The privacy policy (3 September 2026) is written mainly around WhatsApp data and gives no retention period. The compliance page says recordings are kept for the life of the account and deleted on request, and audio and transcript storage are per-agent settings. No DPA found (12 of 30). The reference promises additive changes within /v1, but removals shipped on 23 and 25 September and 10 and 30 October 2026 with same-day notes and migration tables and no notice period (6 of 20). The privacy policy mentions vetted providers without naming them. The compliance page now says call records, transcripts and recordings are stored on AWS in Mumbai (ap-south-1), that model providers process in their own regions and that Plivo carries calls; no sub-processor list was found, so the partial is carried (6 of 20). 10 + 12 + 6 + 6 = 34.

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

Vocily AI 46

Bearer keys are shown once, revocable in the dashboard and bound to one workspace, and they can't reach billing, members or key management. There are no scopes to set and no rotation route, and webhooks are HMAC-signed with a timestamp and a rotation overlap (22 of 30). No read-only key. Spending and contractual actions stay in the dashboard, a version answers calls only after publish and make-live, and the memory erase previews by default (10 of 20). Transcripts and caller speech are untrusted content, and the API docs have no prompt-injection guidance. The site describes topic fencing and an empty-knowledge-base guard (4 of 15). Each call keeps a record with cost and version, webhooks have a delivery log and every response a request id, but we found no audit log of account or key actions (8 of 15). No security.txt (404 on 4 November), disclosure policy, bug bounty or certification. The compliance page says Vocily doesn't claim certification, and the privacy policy states encryption in transit and at rest (2 of 20). 22 + 10 + 4 + 8 + 2 = 46.

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

Vocily AI 61

The latest dated API change is 30 October 2026 (send_whatsapp_template moved to the dashboard), 5 days before this check (30). Nine dated entries since 6 August: 23, 25, 27 and 30 September and 10, 15, 17, 20 and 30 October (20). A public change log, a Discord server and a founder email address are the channels found, and we didn't test whether they answer (8 of 15 for a closed service). No official SDK found; the developer page now says to generate a typed client from the OpenAPI file (0 of 15). There is no package to assess. The OpenAPI file was last modified on 31 October 2026 (3 of 10, carried). 30 + 20 + 8 + 0 + 3 = 61.