Kontent.ai vs Payload

Kontent.ai

Management API keys take per-area permissions, environment limits and an expiry from one minute to two years, and changes made with a key are named in the audit log. Rate limits and Retry-After are documented. No price is published, and no OpenAPI file was found. Access starts with a 30-day trial that a person opens in a browser.

Payload

Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.

Kontent.ai

1. Send Authorization: Bearer <key> to https://manage.kontent.ai/v2/projects/{environment_id}/.... The Management API must be switched on under Environment settings, General, Enabled APIs first
2. Ask for a Management API key with only the permissions the task needs. Read content alone gives a read-only key, and keys expire after six months by default
3. Stay under 10 requests a second and 400 a minute per environment, send requests one at a time, and wait the seconds in Retry-After on a 429
4. Page lists by passing the continuation_token from the response back in the x-continuation header
5. Create items with an external_id and write with the upsert PUT at /items/external-id/{id} so a retry after a lost response does not create a duplicate
6. With the MCP server, call get-patch-guide before any patch tool, and use a client that prompts on destructiveHint

Payload

1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing
2. Send REST keys as Authorization: {collection-slug} API-Key {key} and MCP keys as Authorization: Bearer {key}. The two key kinds are separate
3. To publish, set _status: 'published' in the data. The draft parameter only relaxes validation and chooses where an update is written
4. Upload files with multipart POST to the upload collection, with other fields as JSON in _payload. No MCP upload tool is documented
5. Roll back with POST /api/{collection-slug}/versions/:id after listing versions. Versions exist only where the collection config enables them