Microsoft Graph Calendar API vs Truto Unified Calendar API

Microsoft Graph Calendar API 76

msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August to v1.65.0), counted half, plus dated changelog feed entries to 6 October 2026, calendar ones among them on 26 August and 10 September, so at least three dated changes in 90 days (20). A public changelog and SDK issue trackers, but security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from 19 September 2023 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.

Truto Unified Calendar API 50

No API changelog, so the last API change can't be dated; the official @truto/truto-link-sdk was published as 1.3.5 on 26 October 2026, which we take as the latest dated release (20 of 30, since it is the connection widget, not the calendar API). Six Link SDK versions since 8 August (10 of 20, for the same reason). Support through Slack on paid plans, with no public tracker (5 of 15). A CLI and the Link SDK are official, with no API client (10 of 15). Package health not checked (5 of 10). 20 + 10 + 5 + 10 + 5 = 50.

Microsoft Graph Calendar API 72

OAuth 2.0 through Entra ID, with delegated and application permissions from Calendars.ReadBasic (no bodies) through Calendars.Read to Calendars.ReadWrite (30). Calendars.ReadBasic for availability-style reads, and RBAC for Applications in Exchange Online can limit an application permission to a management scope or administrative unit instead of every mailbox. Nothing asks for confirmation before a delete (18). Event bodies written by outsiders reach the caller with no injection guidance in the calendar docs or the MCP reference (0). Graph activity logs record app, user, IP, URI, status and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026 and still carries it on 2 November, Office 365 has a SOC 2 Type 2 report, and MSRC publishes CVEs for Exchange Online and Microsoft Graph, counted under negative events. Two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 5). 30+18+0+12+12 = 72.

Truto Unified Calendar API 52

API tokens are per environment and sent as Bearer headers; no scopes or expiry for them were found (20 of 30). Per-account MCP servers can be limited to read methods or tags and set to expire, and the customer's connection form can restrict access to specific resources, but the REST token reaches every integrated account in its environment (14 of 20). Event titles, descriptions and attendee text from outside parties pass through, and no prompt-injection guidance was found (0). Plans keep request logs 30 or 90 days (10 of 15). SOC 2 is stated in a 2023 blog post, with no trust page, security.txt or disclosure policy found (8 of 20). 20 + 14 + 0 + 10 + 8 = 52.

Microsoft Graph Calendar API 93

OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL metadata (25). No llms.txt, but every learn.microsoft.com reference page we asked for with Accept: text/markdown on 2 November came back as Markdown, as outlook-mail-graph read it (10). Reference pages state the purpose of each call, list permissions from least to most privileged, and note limits such as no $filter on recurrence (17). Typed properties and enums in the metadata (13). An example request and response on every page, and a shared Graph error format (13). v1.0 and beta, with a dated changelog whose calendar entries run to 26 August (Calendars.Read.All and Calendars.ReadWrite.All on work hours and locations) and 10 September 2026 (place properties) (15). 25+10+17+13+13+15 = 93.

Truto Unified Calendar API 75

An OpenAPI specification is linked from the RFC 9727 API catalogue, but the file timed out and was not read, so it is credited as published and unverified (20 of 25). llms.txt and a Markdown sibling for every page (10). Parameter descriptions say what each does and what it falls back to, such as end_time defaulting to the month of start_time (15 of 20). Types, required marks and allowed values such as focus_time and out_of_office (13 of 15). One documented error shape with provider and Truto fields; few request examples on the reference pages read (12 of 15). Deprecated admin endpoints are marked, but no API changelog was found (5 of 15). 20 + 10 + 15 + 13 + 12 + 5 = 75.

Microsoft Graph Calendar API 88

$select, $top, bodyPreview and Prefer: outlook.body-content-type="text" keep event payloads small (23). @odata.nextLink paging, $filter, $orderby and calendarView for expanded recurrences in a window (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). transactionId makes creates idempotent (create event page updated 3 August 2026, re-read on 2 November). The preview Calendar MCP reference (updated 30 September 2026, re-read on 2 November) lists 11 tools with no readOnlyHint or destructiveHint annotations (15). Official SDKs in .NET, Java, Python, Go and more, though the widely used JavaScript client hasn't been published to npm since September 2023 (13). 23+20+17+15+13 = 88.

Truto Unified Calendar API 71

truto_exclude_fields, truto_ignore_remote_data, truto_key_by and response formats (unified, raw, normalized) size the reply (22 of 25). Query operators such as [gt] and [in], sort_by, limit and cursors, with a meta endpoint that says which filters each vendor supports (18 of 20). Errors name the HTTP status and say whether Truto or the provider failed, with the provider's message extracted (18 of 20). No idempotency key found for creates (5 of 20). Every call needs only the token and integrated_account_id; a CLI and the Link SDK exist, with no general API SDK found (8 of 15). 22 + 18 + 18 + 5 + 8 = 71.

Microsoft Graph Calendar API 35

No x402, MPP or L402 (0). Calendar endpoints aren't on the metered API list (re-read on 2 November, only SharePoint and OneDrive assignSensitivityLabel is metered) and Microsoft 365 plan prices are public, but work calendars need a licensed mailbox (15). Personal Outlook.com accounts work with delegated permissions at no cost and no card (20). A person registers an app in Entra and, for application permissions, an admin consents (0). 0+15+20+0 = 35.

Truto Unified Calendar API 20

No x402, MPP or L402 (0). Plan prices per connector a year are public, with unlimited calls (10). A free 30-day sandbox is given after a work-email request reviewed within a business day (10 of 20). A person requests access or books a demo (0). 0 + 10 + 10 + 0 = 20.

Microsoft Graph Calendar API 76

Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). Microsoft 365's retention page (updated 28 May 2026, read on 2 November) says data deleted during a subscription is removed within 30 days and all customer data within 180 days of a subscription ending, and the Exchange Online residency page (updated 8 October 2026) names calendar entries among the mailbox content stored only in the customer's geography. We didn't read the privacy statement or data protection addendum (20). A written policy of at least 24 months' notice before a GA API or a version is retired (versioning page re-read on 2 November), and dated preview notices such as the Calendar MCP being kept only for backward compatibility (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10). 15+20+20+10 = 65, read as outlook-mail-graph.

Truto Unified Calendar API 61

Closed service under terms naming Yin Yang Inc. (15 of 30). Truto says it stores no customer data and calls vendors live, logs are kept 30 or 90 days by plan, data is kept 15 days after termination, and a DPA is public (25 of 30). Deprecated admin endpoints are marked with no policy or dates (6 of 20). Enterprise customers can choose a data region and tokens can be stored regionally; no subprocessor list was found (8 of 20). 15 + 25 + 6 + 8 = 54.