Kestra vs Prismatic

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Prismatic

The GraphQL API covers 120 queries and 124 mutations with typed inputs, cursor pagination and Markdown documentation, and tokens follow seven user roles. No price is published, paid use runs under an agreement that is not public, and no API rate limit or idempotency key was found in the reviewed documentation.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Prismatic

1. Have a person run prism login once, then store the output of prism me:token --type refresh as PRISM_REFRESH_TOKEN. Access tokens last 7 days
2. Read the errors array on every mutation. A failed mutation still returns HTTP 200
3. Pass sortBy with CREATED_AT when paging. Without a sort order pages can repeat or skip records
4. Use the regional host for the tenant, such as app.eu-west-1.prismatic.io and mcp.eu-west-1.prismatic.io
5. Create a guest user for a read-only agent, because tokens have no scopes of their own