Microsoft Graph Calendar API vs YouCanBookMe API

Microsoft Graph Calendar API 93

OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL metadata (25). No llms.txt, but every learn.microsoft.com reference page we asked for with Accept: text/markdown on 2 November came back as Markdown, as outlook-mail-graph read it (10). Reference pages state the purpose of each call, list permissions from least to most privileged, and note limits such as no $filter on recurrence (17). Typed properties and enums in the metadata (13). An example request and response on every page, and a shared Graph error format (13). v1.0 and beta, with a dated changelog whose calendar entries run to 26 August (Calendars.Read.All and Calendars.ReadWrite.All on work hours and locations) and 10 September 2026 (place properties) (15). 25+10+17+13+13+15 = 93.

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Microsoft Graph Calendar API 88

$select, $top, bodyPreview and Prefer: outlook.body-content-type="text" keep event payloads small (23). @odata.nextLink paging, $filter, $orderby and calendarView for expanded recurrences in a window (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). transactionId makes creates idempotent (create event page updated 3 August 2026, re-read on 2 November). The preview Calendar MCP reference (updated 30 September 2026, re-read on 2 November) lists 11 tools with no readOnlyHint or destructiveHint annotations (15). Official SDKs in .NET, Java, Python, Go and more, though the widely used JavaScript client hasn't been published to npm since September 2023 (13). 23+20+17+15+13 = 88.

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Microsoft Graph Calendar API 65

Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20), per the 1 October check. Its robots.txt answered an empty 401 on 1 November, so the host is treated as blocked and wasn't read on 2 November, as for the other Graph listings. No readable components or incident history (5). Calendar resources (event, calendar, calendarGroup) fall under the Outlook limits of 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, under a global 130,000 requests per 10 seconds per app (throttling page updated 17 September 2026, re-read on 2 November) (15). 429 responses carry Retry-After and throttle headers with backoff guidance, and event creation takes a transactionId that Microsoft documents as reducing unnecessary retries on the server, so a retried create isn't doubled (15). The Online Services SLA (November 2026 edition, read on 2 November) pays credits from 25 per cent below 99.9 per cent uptime for Exchange Online, the service that holds every work calendar, but measures downtime as users unable to send or receive email with Outlook Web Access and has no Microsoft Graph entry. None of Exchange Online's four service levels (Outlook Web Access email, email delivery time, guaranteed delivery, email ingress and egress) measures calendar access, so a calendar outage isn't downtime under it. microsoft-teams and outlook-mail-graph take 7 because their levels measure the same function the API serves (messaging and meetings, sending and receiving email), and onedrive-sharepoint 10 because its level covers reading and writing the content its API reads and writes. Here no level covers what the API does (0). Calendar endpoints are generally available on v1.0 (10). 20+5+15+15+0+10 = 65.

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Microsoft Graph Calendar API 72

OAuth 2.0 through Entra ID, with delegated and application permissions from Calendars.ReadBasic (no bodies) through Calendars.Read to Calendars.ReadWrite (30). Calendars.ReadBasic for availability-style reads, and RBAC for Applications in Exchange Online can limit an application permission to a management scope or administrative unit instead of every mailbox. Nothing asks for confirmation before a delete (18). Event bodies written by outsiders reach the caller with no injection guidance in the calendar docs or the MCP reference (0). Graph activity logs record app, user, IP, URI, status and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026 and still carries it on 2 November, Office 365 has a SOC 2 Type 2 report, and MSRC publishes CVEs for Exchange Online and Microsoft Graph, counted under negative events. Two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 5). 30+18+0+12+12 = 72.

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Microsoft Graph Calendar API 76

msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August to v1.65.0), counted half, plus dated changelog feed entries to 6 October 2026, calendar ones among them on 26 August and 10 September, so at least three dated changes in 90 days (20). A public changelog and SDK issue trackers, but security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from 19 September 2023 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.

YouCanBookMe API 28

Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.

Microsoft Graph Calendar API 76

Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). Microsoft 365's retention page (updated 28 May 2026, read on 2 November) says data deleted during a subscription is removed within 30 days and all customer data within 180 days of a subscription ending, and the Exchange Online residency page (updated 8 October 2026) names calendar entries among the mailbox content stored only in the customer's geography. We didn't read the privacy statement or data protection addendum (20). A written policy of at least 24 months' notice before a GA API or a version is retired (versioning page re-read on 2 November), and dated preview notices such as the Calendar MCP being kept only for backward compatibility (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10). 15+20+20+10 = 65, read as outlook-mail-graph.

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.