Mattermost vs Zulip

Mattermost

The REST API v4 has a public OpenAPI source of about 600 operations, a dated changelog with API changes per release, and 16 server releases in 90 days. Personal access tokens have no scopes or expiry, paid editions have no public price, and 52 dot releases in twelve months carried security fixes, three of them rated critical.

Zulip

The REST API is the one Zulip's own apps use, with a public OpenAPI file of 166 operations, a changelog by feature level and a status page showing no incidents in 90 days. Each account has one API key with no scopes, and the server took 13 security advisories in twelve months, all fixed and published.

Mattermost

1. Ask the system admin for a bot account and its token. Bot creation and personal access tokens are both off until enabled in the System Console
2. Send Authorization: Bearer <token> to https://<server>/api/v4. Use me in place of a user id for the token's own account
3. Page with page and per_page. The maximum is 200, the default 60, and larger values are cut without an error
4. Read the error id and status_code. A 501 means the server's edition or licence does not include that endpoint
5. If the server has rate limiting on, read X-Ratelimit-Remaining and X-Ratelimit-Reset. The 429 body is the plain text limit exceeded

Zulip

1. Ask the organisation for a bot of the most limited type that fits. Use an incoming webhook bot when the task only posts messages
2. Authenticate with HTTP Basic, the bot's email as user and its API key as password, against https://<organisation>.zulipchat.com/api/v1
3. Read code, not msg, on errors. msg is translated into the account's language
4. On RATE_LIMIT_HIT wait the seconds in retry-after. The default limit is 200 requests a minute per user
5. Fetch history with GET /messages, a narrow filter, an anchor and num_before or num_after, at most 1,000 a batch as the docs recommend