{ "data": { "a": { "slug": "microsoft-graph-calendar", "name": "Microsoft Graph Calendar API", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/graph/outlook-calendar-concept-overview", "kind": "http-api", "category": "scheduling", "summary": "Calendar endpoints of Microsoft Graph for Outlook, Microsoft 365 and Exchange Online.", "url": "https://www.anchorterminal.com/tools/microsoft-graph-calendar", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-graph-calendar.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-graph-calendar.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-graph-calendar.json", "dns": "microsoft-graph-calendar.grade.anchorterminal.com", "repo": "https://github.com/microsoftgraph/msgraph-sdk-javascript", "license": "MIT (SDKs)", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0", "packages": [ { "registry": "npm", "name": "@microsoft/microsoft-graph-client" }, { "registry": "pypi", "name": "msgraph-sdk" } ], "auth": "oauth", "authNotes": "OAuth 2.0 tokens from Microsoft Entra ID. Delegated permissions (Calendars.Read, Calendars.ReadWrite) act as a signed-in user. Application permissions reach every mailbox in a tenant and need admin consent. Personal Outlook.com accounts work with delegated permissions.", "pricing": "byo-plan", "pricingNotes": "Calendar endpoints aren't metered. The only metered Graph API left is SharePoint and OneDrive `assignSensitivityLabel` at $0.00185 a call (https://learn.microsoft.com/en-us/graph/metered-api-list). Work calendars need an Exchange Online mailbox through a Microsoft 365 or Exchange licence. The Work IQ MCP servers need a Microsoft 365 Copilot licence (https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": 834, "npmWeekly": 2699759, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://learn.microsoft.com/en-us/graph/outlook-calendar-concept-overview", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "calendar.read", "calendar.write", "calendar.availability", "calendar.webhooks" ], "tags": [ "hosted", "official", "oauth", "webhooks", "typescript", "python", "enterprise" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 58.7, "grade": "C", "agentReady": false, "rank": 660, "ranked": true, "rankOf": 1349, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 88, "maintenance": 76, "payments": 35, "reliability": 65, "schema": 93, "security": 72, "transparency": 76 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -14, "negativeNotes": [ "2026-06-16 and 2026-10-15: two security fixes merged into msgraph-sdk-javascript, a token leak through URL userinfo host confusion (5438ae9, 16 June) and stripping the Cookie header on cross-origin redirects (38867d1, written 13 October and merged through pull request 2007 on 15 October). The repository's package.json says 3.0.8, but on 2 November 2026 no 3.0.8 tag exists (newest 3.0.7, September 2023) and there is no advisory. A fix to the listing's own package in no release takes -3, the two folded into one term (https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/38867d1, https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/5438ae90f50ef15d3656f0cf9c5485deee351f19)", "2026-03-19: CVE-2026-26137, Exchange Online elevation of privilege (SSRF, CVSS 9.9, Critical, needs a signed-in attacker), fully mitigated by Microsoft, not disclosed or exploited. -1 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137)", "2026-06-04: CVE-2026-48579, Exchange Online information disclosure (improper authorisation, CVSS 9.1, Critical, no sign-in needed), mitigated by Microsoft. -2 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48579)", "2026-06-04: CVE-2026-47655, Microsoft Graph information disclosure (CVSS 6.5, Critical by MSRC, needs a signed-in attacker), mitigated by Microsoft. -1 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47655)", "2026-06-18: CVE-2026-48582, Exchange Online elevation of privilege (missing authorisation, CVSS 9.6, Critical, needs a signed-in attacker), mitigated by Microsoft. -1 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48582)", "2026-07-23: CVE-2026-56191, Exchange Online tampering (improper authentication, CVSS 10.0, Critical, no sign-in needed), mitigated by Microsoft. -2 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56191)", "2026-07-23: CVE-2026-49159, Microsoft Graph information disclosure (CVSS 6.5, Critical by MSRC, needs a signed-in attacker), mitigated by Microsoft. -1 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49159)", "2026-08-20: CVE-2026-65801, Exchange Online elevation of privilege (SSRF, CVSS 10.0, Critical, no sign-in needed), mitigated by Microsoft. -2 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65801)", "2026-10-22: CVE-2026-96185, Exchange Online remote code execution (stack overflow, CVSS 7.5, Critical, needs a signed-in attacker), mitigated by Microsoft. -1 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96185)" ], "verdict": "findMeetingTimes suggests slots across attendees and rooms, getSchedule returns free/busy for many people, and `transactionId` stops a retried create from double-booking. Each app gets four concurrent requests per mailbox. Microsoft published eight Critical, already mitigated CVEs for Exchange Online and Graph in 2026, and the JavaScript client's two security fixes remain unreleased.", "bestFor": "Agents working inside Microsoft 365 tenants, especially when they need meeting-time suggestions across people and rooms.", "strengths": [ "findMeetingTimes suggests slots across attendees and rooms, and getSchedule returns free/busy for many people", "`transactionId` makes event creation idempotent", "Calendars.ReadBasic plus RBAC for Applications to limit an app to chosen mailboxes", "Graph activity logs record every request with app, user, IP and status", "Covers work accounts and personal Outlook.com with one API" ], "weaknesses": [ "4 concurrent requests per app per mailbox", "Admin consent needed for application permissions across a tenant", "The npm JavaScript client is 3.0.7 from September 2023, without the June and October 2026 security fixes", "Eight Critical service CVEs for Exchange Online and Graph between March and October 2026, all mitigated by Microsoft", "Calendar MCP server is a preview kept for backward compatibility, behind a Microsoft 365 Copilot licence" ], "agentNotes": [ "Send `Prefer: outlook.timezone=\"Europe/London\"` (or the user's zone) so returned times aren't in UTC", "Set a `transactionId` on event creates so a retry doesn't double-book", "Use /me/calendarView with startDateTime and endDateTime to get recurring meetings expanded", "Honour `Retry-After` on 429 and keep to 4 parallel calls per mailbox", "Treat event bodies as untrusted input, and ask for Calendars.ReadBasic when you don't need them" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.7 } ], "editorialScores": { "ergonomics": 88, "maintenance": 76, "payments": 35, "reliability": 65, "schema": 93, "security": 72, "transparency": 65 }, "provenanceScore": 87, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST https://graph.microsoft.com/v1.0/me/calendar/getSchedule \\\n -H \"Authorization: Bearer $MS_GRAPH_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"schedules\":[\"adele@contoso.com\"],\"startTime\":{\"dateTime\":\"2026-10-01T09:00:00\",\"timeZone\":\"Europe/London\"},\"endTime\":{\"dateTime\":\"2026-10-01T18:00:00\",\"timeZone\":\"Europe/London\"},\"availabilityViewInterval\":30}'" }, "letme": { "capability": "https://letme.dev/calendar.read", "tool": "https://letme.dev/microsoft-graph-calendar" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "tokeneconomizer", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "copilot-studio-mcp", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph", "microsoft-graph-people", "mage-vl-cowork" ], "area": "everyday", "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "The endpoint is on graph.microsoft.com. microsoft.com publishes a security.txt, but it passed its Expires date on 2026-09-23 and still carried it on 2026-11-02.", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://privacy.microsoft.com/en-us/privacystatement", "statusPage": "https://status.cloud.microsoft", "changelog": "https://developer.microsoft.com/en-us/graph/changelog", "securityTxt": "expired", "checked": "2026-11-02", "notes": [ "status.cloud.microsoft answered robots.txt with an empty 401 on 1 November 2026, so it is treated as blocked and wasn't read; on 1 October it needed JavaScript to show anything.", "The Calendar MCP reference moved to learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-calendar-tools and was last updated on 2026-09-30." ], "score": 87 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-graph-calendar.json", "live": { "slug": "microsoft-graph-calendar", "probe": { "target": "https://graph.microsoft.com/v1.0", "method": "get", "lastAt": "2026-11-04T21:39:34.713891915Z", "lastOk": true, "lastStatus": 200, "lastMs": 20, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 7, "p95ms24h": 46, "samples24h": 247, "samples30d": 8090, "days": [ { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 272, "ok": 272 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 223, "ok": 223 } ] }, "vendorStatus": { "page": "https://status.cloud.microsoft", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T15:36:56.18227852Z" }, "versions": [ { "registry": "github", "name": "microsoftgraph/msgraph-sdk-javascript", "version": "3.0.7", "released": "2023-09-19", "seenAt": "2026-11-04T20:36:00.490801539Z" }, { "registry": "npm", "name": "@microsoft/microsoft-graph-client", "version": "3.0.7", "seenAt": "2026-11-04T20:35:59.991185618Z" }, { "registry": "pypi", "name": "msgraph-sdk", "version": "1.65.0", "released": "2026-10-22", "seenAt": "2026-11-04T20:36:00.218542901Z" } ], "githubStars": 836, "npmWeekly": 3257314, "pypiWeekly": 1623190, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "expired", "expires": "2026-09-23T16:00:00.000Z", "checkedAt": "2026-11-04T15:53:07.385907604Z" }, "domain": { "domain": "microsoft.com", "registered": "1991-05-02", "source": "https://rdap.verisign.com/com/v1/domain/microsoft.com", "checkedAt": "2026-11-01T14:14:19.336136409Z" }, "pages": [ { "url": "https://developer.microsoft.com/en-us/graph/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-07T18:04:04.158031617Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7bb1f9551c94" }, { "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "kind": "terms", "status": 200, "checkedAt": "2026-10-07T18:07:06.319848234Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1a1ee1c20d9a" } ], "github": { "repo": "microsoftgraph/msgraph-sdk-javascript", "checkedAt": "2026-11-02T09:06:51.445549725Z", "stars": 836, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-28T20:16:39Z", "openIssues": 79, "openPRs": 40, "issuesOpened90d": 3, "issuesClosed90d": 1, "prsMerged90d": 7, "ci": { "branch": "dev", "runs": 6, "success": 6, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-23T18:59:51Z" }, "replies": { "sampled": 25, "unanswered": 24, "medianDays": 5.6 } }, "updatedAt": "2026-11-04T21:39:34.713891915Z" } }, "answer": "Microsoft Graph Calendar API scores 58.7 (C) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in every scored category.", "b": { "slug": "youcanbookme", "name": "YouCanBookMe API", "vendor": "AI Software (Capacity) UK Ltd, trading as YouCanBookMe", "vendorUrl": "https://youcanbook.me", "kind": "http-api", "category": "scheduling", "summary": "YouCanBookMe is a booking-page service from the UK company of the same name, owned by Capacity since 2025. Its REST API manages account details, booking pages (profiles) and bookings over HTTP Basic auth, with webhooks from booking notifications.", "url": "https://www.anchorterminal.com/tools/youcanbookme", "markdownUrl": "https://www.anchorterminal.com/tools/youcanbookme.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/youcanbookme.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/youcanbookme.json", "dns": "youcanbookme.grade.anchorterminal.com", "transports": [ "http" ], "remoteUrl": "https://api.youcanbook.me/v1", "packages": [], "auth": "api-key", "authNotes": "HTTP Basic authentication with the account email address or account ID as the username and an account API key as the password. Only the Account Owner can generate, view, copy or delete the key, under Account Password \u0026 Security \u003e Authentication and API, and the help centre says the API key is available on the Team plan. No scopes, expiry or per-user keys are described. Administrators and Contributors must ask the owner for the key.", "pricing": "freemium", "pricingNotes": "Free plan with 1 calendar, 1 booking page and 30 bookings a month, with YouCanBookMe branding. Individual $9, Professional $13 and Teams $18 a seat a month, with 10 per cent off yearly and 20 per cent off for two years ($7.20, $10.40 and $14.40), per the help centre's pricing article. 14-day trial of every feature with no card, per the pricing page. API access is listed under the Team plan; webhooks need Professional or Teams.", "priceSummary": "$9 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the pricing page, in the help centre API and webhook articles or in the API's error response (checked 2026-11-03). The API reference itself could not be read.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://ycbm.stoplight.io/", "capabilities": [ "calendar.booking", "calendar.availability", "calendar.webhooks" ], "tags": [ "hosted", "freemium", "free-tier", "free-trial", "no-card", "api-key", "webhooks", "soc2", "iso27001", "uk", "closed-source" ], "lastRelease": "2026-09-01", "graded": true, "anchor": { "graded": true, "score": 22.5, "grade": "F", "agentReady": false, "rank": 1287, "ranked": true, "rankOf": 1349, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 13, "maintenance": 28, "payments": 30, "reliability": 15, "schema": 10, "security": 24, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-03" }, "negative": 0, "verdict": "A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified.", "bestFor": "A booking-page product for small businesses, closest to calendly and savvycal in scheduling.", "strengths": [ "SOC 2 Type II and ISO/IEC 27001:2022 (certificate issued 20 February 2024) listed on the security page, with AES-256 at rest on AWS", "Free plan and a 14-day trial of every feature with no card", "Privacy notice (16 March 2026) states retention periods, 24 months for booking data by default, and says booking data is not used to train AI models", "Webhook notifications on six booking triggers with a JSON payload the user shapes, on Professional and Teams", "The API answers with a JSON error envelope carrying a code, message and status, and declares its version in an `x-api-version` header" ], "weaknesses": [ "The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge", "One account-wide API key over HTTP Basic auth, created only by the Account Owner, with no scopes or expiry documented", "API access is listed only on the Team plan ($18 a seat a month)", "No rate limits, 429 handling, idempotency keys, OpenAPI file, llms.txt or official SDK were found", "No security.txt, bug bounty or disclosure policy, and the status page at youcanbookmestatus.com did not resolve for us" ], "agentNotes": [ "Ask the Account Owner for the account ID and API key, since Administrators and Contributors cannot generate one, and send them as HTTP Basic credentials", "Read the API reference at ycbm.stoplight.io in a browser before planning calls; its endpoints and parameters were not readable to us", "Treat the key as full account access and keep it out of logs, since no scoped or read-only key is documented", "Expect a JSON error body with `code`, `message` and `status` on failures, and check for an existing booking before repeating a create, since no idempotency key is documented", "Use booking-page webhooks for booking, reschedule, cancel, reminder, follow-up and no-show events instead of polling" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 22.5 } ], "editorialScores": { "ergonomics": 13, "maintenance": 28, "payments": 30, "reliability": 15, "schema": 10, "security": 24, "transparency": 52 }, "provenanceScore": 70, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -u \"$YCBM_ACCOUNT_ID:$YCBM_API_KEY\" https://api.youcanbook.me/v1/profiles" }, "letme": { "capability": "https://letme.dev/calendar.booking", "tool": "https://letme.dev/youcanbookme" }, "area": "everyday", "unitPrices": [ { "item": "Individual", "unit": "seat-month", "usd": 9, "note": "$8.10 a month yearly, $7.20 over two years, per the help centre" }, { "item": "Professional", "unit": "seat-month", "usd": 13, "note": "$11.70 a month yearly, $10.40 over two years" }, { "item": "Teams", "unit": "seat-month", "usd": 18, "note": "Per seat. $16.20 yearly, $14.40 over two years. The plan that lists API access" } ], "provenance": { "legalEntity": "AI Software (Capacity) UK Ltd", "domain": "youcanbook.me", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://youcanbook.me/terms", "privacy": "https://youcanbook.me/privacy", "statusPage": "https://www.youcanbookmestatus.com", "changelog": "https://youcanbook.me/product-updates", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms (last updated 18 March 2026) name AI Software (Capacity) UK Ltd, trading as YouCanBookMe, under English law. Clause 15.3 bars data mining, robots and similar extraction tools without written consent, and clause 7.2 bars downloading the Site's software. Recorded as a fact; the public pages were read.", "The privacy notice (16 March 2026) gives company number 7221202, AWS hosting in the United States, a DPA on request through HelloSign, and retention of 24 months for booking data and up to 7 years for support messages.", "youcanbook.me/robots.txt disallows only HubSpot preview and preference paths. support.youcanbook.me/robots.txt disallows account, search and request paths; the API article there answered a Cloudflare challenge (403), which is the host's block, not a robots rule. ycbm.capacity.com and ycbm.stoplight.io allow all.", "The status page linked from youcanbook.me/help, www.youcanbookmestatus.com, did not resolve from our reader on 3 November 2026 (DNS), with or without www, so no incident history was read.", "youcanbook.me/.well-known/security.txt returns 404. The security page gives compliance@youcanbook.me as its contact.", "RDAP for youcanbook.me (rdap.nic.me) could not be reached from our shell, so the registration date is blank.", "The product updates page at youcanbook.me/product-updates is dated by month; its newest entry is September 2026 (registered SMS numbers), which lastRelease records as the first of that month." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/youcanbookme.json", "live": { "slug": "youcanbookme", "probe": { "target": "https://api.youcanbook.me/v1", "method": "get", "lastAt": "2026-11-04T21:39:54.948803292Z", "lastOk": true, "lastStatus": 400, "lastMs": 406, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 200, "p95ms24h": 447, "samples24h": 64, "samples30d": 64, "days": [ { "date": "2026-11-04", "probes": 64, "ok": 64 } ] }, "vendorStatus": { "page": "https://www.youcanbookmestatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T21:27:01.611847667Z" }, "securityTxt": { "url": "https://youcanbook.me/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:28.156243558Z" }, "updatedAt": "2026-11-04T21:39:54.948803292Z" } }, "edges": [ { "by": 83, "category": "schema", "leads": "microsoft-graph-calendar", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL metadata (25). No llms.txt, but every learn.microsoft.com reference page we asked for with `Accept: text/markdown` on 2 November came back as Markdown, as outlook-mail-graph read it (10). Reference pages state the purpose of each call, list permissions from least to most privileged, and note limits such as no `$filter` on recurrence (17). Typed properties and enums in the metadata (13). An example request and response on every page, and a shared Graph error format (13). v1.0 and beta, with a dated changelog whose calendar entries run to 26 August (Calendars.Read.All and Calendars.ReadWrite.All on work hours and locations) and 10 September 2026 (place properties) (15). 25+10+17+13+13+15 = 93.", "b": "The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with `code`, `errors`, `httpCode`, `message` and `status`, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and `x-api-version: 1.18` and `x-api-revision` headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10." }, "scores": { "a": 93, "b": 10 } }, { "by": 75, "category": "ergonomics", "leads": "microsoft-graph-calendar", "name": "Agent ergonomics", "reasons": { "a": "`$select`, `$top`, `bodyPreview` and `Prefer: outlook.body-content-type=\"text\"` keep event payloads small (23). `@odata.nextLink` paging, `$filter`, `$orderby` and calendarView for expanded recurrences in a window (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). `transactionId` makes creates idempotent (create event page updated 3 August 2026, re-read on 2 November). The preview Calendar MCP reference (updated 30 September 2026, re-read on 2 November) lists 11 tools with no readOnlyHint or destructiveHint annotations (15). Official SDKs in .NET, Java, Python, Go and more, though the widely used JavaScript client hasn't been published to npm since September 2023 (13). 23+20+17+15+13 = 88.", "b": "Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13." }, "scores": { "a": 88, "b": 13 } }, { "by": 50, "category": "reliability", "leads": "microsoft-graph-calendar", "name": "Reliability", "reasons": { "a": "Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20), per the 1 October check. Its robots.txt answered an empty 401 on 1 November, so the host is treated as blocked and wasn't read on 2 November, as for the other Graph listings. No readable components or incident history (5). Calendar resources (event, calendar, calendarGroup) fall under the Outlook limits of 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, under a global 130,000 requests per 10 seconds per app (throttling page updated 17 September 2026, re-read on 2 November) (15). 429 responses carry `Retry-After` and throttle headers with backoff guidance, and event creation takes a `transactionId` that Microsoft documents as reducing unnecessary retries on the server, so a retried create isn't doubled (15). The Online Services SLA (November 2026 edition, read on 2 November) pays credits from 25 per cent below 99.9 per cent uptime for Exchange Online, the service that holds every work calendar, but measures downtime as users unable to send or receive email with Outlook Web Access and has no Microsoft Graph entry. None of Exchange Online's four service levels (Outlook Web Access email, email delivery time, guaranteed delivery, email ingress and egress) measures calendar access, so a calendar outage isn't downtime under it. microsoft-teams and outlook-mail-graph take 7 because their levels measure the same function the API serves (messaging and meetings, sending and receiving email), and onedrive-sharepoint 10 because its level covers reading and writing the content its API reads and writes. Here no level covers what the API does (0). Calendar endpoints are generally available on v1.0 (10). 20+5+15+15+0+10 = 65.", "b": "Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15." }, "scores": { "a": 65, "b": 15 } }, { "by": 48, "category": "security", "leads": "microsoft-graph-calendar", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 through Entra ID, with delegated and application permissions from Calendars.ReadBasic (no bodies) through Calendars.Read to Calendars.ReadWrite (30). Calendars.ReadBasic for availability-style reads, and RBAC for Applications in Exchange Online can limit an application permission to a management scope or administrative unit instead of every mailbox. Nothing asks for confirmation before a delete (18). Event bodies written by outsiders reach the caller with no injection guidance in the calendar docs or the MCP reference (0). Graph activity logs record app, user, IP, URI, status and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026 and still carries it on 2 November, Office 365 has a SOC 2 Type 2 report, and MSRC publishes CVEs for Exchange Online and Microsoft Graph, counted under negative events. Two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 5). 30+18+0+12+12 = 72.", "b": "One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24." }, "scores": { "a": 72, "b": 24 } }, { "by": 48, "category": "maintenance", "leads": "microsoft-graph-calendar", "name": "Maintenance \u0026 community", "reasons": { "a": "msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August to v1.65.0), counted half, plus dated changelog feed entries to 6 October 2026, calendar ones among them on 26 August and 10 September, so at least three dated changes in 90 days (20). A public changelog and SDK issue trackers, but security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from 19 September 2023 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.", "b": "Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28." }, "scores": { "a": 76, "b": 28 } }, { "by": 15, "category": "transparency", "leads": "microsoft-graph-calendar", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). Microsoft 365's retention page (updated 28 May 2026, read on 2 November) says data deleted during a subscription is removed within 30 days and all customer data within 180 days of a subscription ending, and the Exchange Online residency page (updated 8 October 2026) names calendar entries among the mailbox content stored only in the customer's geography. We didn't read the privacy statement or data protection addendum (20). A written policy of at least 24 months' notice before a GA API or a version is retired (versioning page re-read on 2 November), and dated preview notices such as the Calendar MCP being kept only for backward compatibility (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10). 15+20+20+10 = 65, read as outlook-mail-graph.", "b": "Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52." }, "scores": { "a": 76, "b": 61 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Microsoft", "b": "AI Software (Capacity) UK Ltd, trading as YouCanBookMe", "name": "Vendor" }, { "a": "https://graph.microsoft.com/v1.0", "b": "https://api.youcanbook.me/v1", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "API key", "name": "Auth" }, { "a": "Your plan", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (SDKs)", "b": "none", "name": "Licence" }, { "a": "11", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-09-01", "name": "Last release" }, { "a": "2025-10-01", "b": "2026-03-18", "name": "Terms last updated" }, { "a": "2026-09-01", "b": "2026-03-16", "name": "Privacy policy last updated" }, { "a": "yes", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "834 stars, 2.7M npm/wk", "b": "none", "name": "Popularity" }, { "a": "3/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Microsoft Graph Calendar API scores 58.7 (C) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, Microsoft Graph Calendar API or YouCanBookMe API?" }, { "answer": "Microsoft Graph Calendar API uses an OAuth sign-in. YouCanBookMe API needs an API key.", "question": "Do Microsoft Graph Calendar API and YouCanBookMe API need an API key?" }, { "answer": "Yes. Microsoft Graph Calendar API has a hosted endpoint at https://graph.microsoft.com/v1.0 and YouCanBookMe API at https://api.youcanbook.me/v1.", "question": "Can an agent call Microsoft Graph Calendar API and YouCanBookMe API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 65 against 15", "Schema \u0026 documentation, 93 against 10", "Agent ergonomics, 88 against 13", "Security \u0026 auth, 72 against 24", "Payments \u0026 pricing, 35 against 30", "Maintenance \u0026 community, 76 against 28", "Transparency \u0026 trust, 76 against 61" ], "also": null, "goodFor": "Agents working inside Microsoft 365 tenants, especially when they need meeting-time suggestions across people and rooms.", "slug": "microsoft-graph-calendar", "watchFor": "4 concurrent requests per app per mailbox" }, { "aheadOn": null, "also": [ "Free to start without a card", "No incidents deducted, where Microsoft Graph Calendar API loses 14 points for them" ], "goodFor": "A booking-page product for small businesses, closest to calendly and savvycal in scheduling.", "slug": "youcanbookme", "watchFor": "The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge" } ], "history": { "microsoft-graph-calendar": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": -6.5, "from": 65.2, "fromGrade": "B", "to": 58.7, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 65.1, "fromGrade": "B", "to": 65.2, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.5, "from": 65.6, "fromGrade": "B", "to": 65.1, "toGrade": "B" } ], "youcanbookme": null }, "job": { "capability": "calendar.availability", "name": "Calendar availability" }, "others": [ { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-microsoft-graph-calendar.json", "title": "Acuity Scheduling API vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/agenda-hero-vs-microsoft-graph-calendar.json", "title": "Agenda Hero vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/agenda-hero-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-microsoft-graph-calendar.json", "title": "Apiroc Unified Calendar API vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/apiroc-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-microsoft-graph-calendar.json", "title": "Aurinko Calendar API vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.json", "title": "Cal.com API v2 + MCP vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/calendly-vs-microsoft-graph-calendar.json", "title": "Calendly API + MCP vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/calendly-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/cozi-vs-microsoft-graph-calendar.json", "title": "Cozi Family Organizer vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/cozi-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/cronofy-vs-microsoft-graph-calendar.json", "title": "Cronofy API vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/cronofy-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/google-calendar-api-vs-microsoft-graph-calendar.json", "title": "Google Calendar API vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/google-calendar-api-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-nylas-calendar.json", "title": "Microsoft Graph Calendar API vs Nylas Calendar and Scheduler API", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-nylas-calendar" }, { "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal.json", "title": "Microsoft Graph Calendar API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-zoom-scheduler.json", "title": "Microsoft Graph Calendar API vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-zoom-scheduler" }, { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme.json", "title": "Acuity Scheduling API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme.json", "title": "Aurinko Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.json", "title": "Cal.com API v2 + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/calendly-vs-youcanbookme.json", "title": "Calendly API + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/calendly-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme.json", "title": "Cronofy API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme.json", "title": "Nylas Calendar and Scheduler API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.json", "title": "SavvyCal API + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler.json", "title": "YouCanBookMe API vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme.json", "title": "Apiroc Unified Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme.json", "title": "Google Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme" } ], "panel": null, "scores": [ { "by": 50, "edge": "microsoft-graph-calendar", "key": "reliability", "microsoft-graph-calendar": 65, "name": "Reliability", "weight": 16, "youcanbookme": 15 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 83, "edge": "microsoft-graph-calendar", "key": "schema", "microsoft-graph-calendar": 93, "name": "Schema \u0026 documentation", "weight": 13, "youcanbookme": 10 }, { "by": 75, "edge": "microsoft-graph-calendar", "key": "ergonomics", "microsoft-graph-calendar": 88, "name": "Agent ergonomics", "weight": 13, "youcanbookme": 13 }, { "by": 48, "edge": "microsoft-graph-calendar", "key": "security", "microsoft-graph-calendar": 72, "name": "Security \u0026 auth", "weight": 14, "youcanbookme": 24 }, { "by": 5, "edge": "microsoft-graph-calendar", "key": "payments", "microsoft-graph-calendar": 35, "name": "Payments \u0026 pricing", "weight": 10, "youcanbookme": 30 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 48, "edge": "microsoft-graph-calendar", "key": "maintenance", "microsoft-graph-calendar": 76, "name": "Maintenance \u0026 community", "weight": 7, "youcanbookme": 28 }, { "by": 15, "edge": "microsoft-graph-calendar", "key": "transparency", "microsoft-graph-calendar": 76, "name": "Transparency \u0026 trust", "weight": 7, "youcanbookme": 61 } ], "summary": "Microsoft Graph Calendar API scores 58.7 (C) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in every scored category. Both do calendar availability.", "tasks": null, "tutorials": [], "verdicts": { "microsoft-graph-calendar": "findMeetingTimes suggests slots across attendees and rooms, getSchedule returns free/busy for many people, and `transactionId` stops a retried create from double-booking. Each app gets four concurrent requests per mailbox. Microsoft published eight Critical, already mitigated CVEs for Exchange Online and Graph in 2026, and the JavaScript client's two security fixes remain unreleased.", "youcanbookme": "A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme", "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.min.md" }, "markdown": "Microsoft Graph Calendar API scores 58.7 (C) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in every scored category. Both do calendar availability.\n\n- Microsoft Graph Calendar API: grade C, 58.7/100, rank #660 of 1349. Markdown https://www.anchorterminal.com/tools/microsoft-graph-calendar.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-graph-calendar.json\n- YouCanBookMe API: grade F, 22.5/100, rank #1287 of 1349. Markdown https://www.anchorterminal.com/tools/youcanbookme.md · JSON https://www.anchorterminal.com/api/v1/tools/youcanbookme.json\n- Best calendar and scheduling APIs for AI agents: https://www.anchorterminal.com/best/scheduling/index.md\n- All 89 scheduling comparisons: https://www.anchorterminal.com/compare/scheduling/index.md\n\n## Which one, for what\n\n### Microsoft Graph Calendar API (C)\n\nGood for: Agents working inside Microsoft 365 tenants, especially when they need meeting-time suggestions across people and rooms.\n\nAhead on:\n- Reliability, 65 against 15\n- Schema \u0026 documentation, 93 against 10\n- Agent ergonomics, 88 against 13\n- Security \u0026 auth, 72 against 24\n- Payments \u0026 pricing, 35 against 30\n- Maintenance \u0026 community, 76 against 28\n- Transparency \u0026 trust, 76 against 61\n\nWatch for: 4 concurrent requests per app per mailbox\n\n### YouCanBookMe API (F)\n\nGood for: A booking-page product for small businesses, closest to calendly and savvycal in scheduling.\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Microsoft Graph Calendar API loses 14 points for them\n\nWatch for: The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Microsoft Graph Calendar API +83\n\n- Microsoft Graph Calendar API (93): OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL metadata (25). No llms.txt, but every learn.microsoft.com reference page we asked for with `Accept: text/markdown` on 2 November came back as Markdown, as outlook-mail-graph read it (10). Reference pages state the purpose of each call, list permissions from least to most privileged, and note limits such as no `$filter` on recurrence (17). Typed properties and enums in the metadata (13). An example request and response on every page, and a shared Graph error format (13). v1.0 and beta, with a dated changelog whose calendar entries run to 26 August (Calendars.Read.All and Calendars.ReadWrite.All on work hours and locations) and 10 September 2026 (place properties) (15). 25+10+17+13+13+15 = 93.\n- YouCanBookMe API (10): The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with `code`, `errors`, `httpCode`, `message` and `status`, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and `x-api-version: 1.18` and `x-api-revision` headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.\n\n### Agent ergonomics: Microsoft Graph Calendar API +75\n\n- Microsoft Graph Calendar API (88): `$select`, `$top`, `bodyPreview` and `Prefer: outlook.body-content-type=\"text\"` keep event payloads small (23). `@odata.nextLink` paging, `$filter`, `$orderby` and calendarView for expanded recurrences in a window (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). `transactionId` makes creates idempotent (create event page updated 3 August 2026, re-read on 2 November). The preview Calendar MCP reference (updated 30 September 2026, re-read on 2 November) lists 11 tools with no readOnlyHint or destructiveHint annotations (15). Official SDKs in .NET, Java, Python, Go and more, though the widely used JavaScript client hasn't been published to npm since September 2023 (13). 23+20+17+15+13 = 88.\n- YouCanBookMe API (13): Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.\n\n### Reliability: Microsoft Graph Calendar API +50\n\n- Microsoft Graph Calendar API (65): Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20), per the 1 October check. Its robots.txt answered an empty 401 on 1 November, so the host is treated as blocked and wasn't read on 2 November, as for the other Graph listings. No readable components or incident history (5). Calendar resources (event, calendar, calendarGroup) fall under the Outlook limits of 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, under a global 130,000 requests per 10 seconds per app (throttling page updated 17 September 2026, re-read on 2 November) (15). 429 responses carry `Retry-After` and throttle headers with backoff guidance, and event creation takes a `transactionId` that Microsoft documents as reducing unnecessary retries on the server, so a retried create isn't doubled (15). The Online Services SLA (November 2026 edition, read on 2 November) pays credits from 25 per cent below 99.9 per cent uptime for Exchange Online, the service that holds every work calendar, but measures downtime as users unable to send or receive email with Outlook Web Access and has no Microsoft Graph entry. None of Exchange Online's four service levels (Outlook Web Access email, email delivery time, guaranteed delivery, email ingress and egress) measures calendar access, so a calendar outage isn't downtime under it. microsoft-teams and outlook-mail-graph take 7 because their levels measure the same function the API serves (messaging and meetings, sending and receiving email), and onedrive-sharepoint 10 because its level covers reading and writing the content its API reads and writes. Here no level covers what the API does (0). Calendar endpoints are generally available on v1.0 (10). 20+5+15+15+0+10 = 65.\n- YouCanBookMe API (15): Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n\n### Security \u0026 auth: Microsoft Graph Calendar API +48\n\n- Microsoft Graph Calendar API (72): OAuth 2.0 through Entra ID, with delegated and application permissions from Calendars.ReadBasic (no bodies) through Calendars.Read to Calendars.ReadWrite (30). Calendars.ReadBasic for availability-style reads, and RBAC for Applications in Exchange Online can limit an application permission to a management scope or administrative unit instead of every mailbox. Nothing asks for confirmation before a delete (18). Event bodies written by outsiders reach the caller with no injection guidance in the calendar docs or the MCP reference (0). Graph activity logs record app, user, IP, URI, status and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026 and still carries it on 2 November, Office 365 has a SOC 2 Type 2 report, and MSRC publishes CVEs for Exchange Online and Microsoft Graph, counted under negative events. Two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 5). 30+18+0+12+12 = 72.\n- YouCanBookMe API (24): One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.\n\n### Maintenance \u0026 community: Microsoft Graph Calendar API +48\n\n- Microsoft Graph Calendar API (76): msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August to v1.65.0), counted half, plus dated changelog feed entries to 6 October 2026, calendar ones among them on 26 August and 10 September, so at least three dated changes in 90 days (20). A public changelog and SDK issue trackers, but security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from 19 September 2023 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.\n- YouCanBookMe API (28): Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.\n\n### Transparency \u0026 trust: Microsoft Graph Calendar API +15\n\n- Microsoft Graph Calendar API (76): Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). Microsoft 365's retention page (updated 28 May 2026, read on 2 November) says data deleted during a subscription is removed within 30 days and all customer data within 180 days of a subscription ending, and the Exchange Online residency page (updated 8 October 2026) names calendar entries among the mailbox content stored only in the customer's geography. We didn't read the privacy statement or data protection addendum (20). A written policy of at least 24 months' notice before a GA API or a version is retired (versioning page re-read on 2 November), and dated preview notices such as the Calendar MCP being kept only for backward compatibility (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10). 15+20+20+10 = 65, read as outlook-mail-graph.\n- YouCanBookMe API (61): Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.\n\n## Score by category\n\n| Category | Weight | Microsoft Graph Calendar API | YouCanBookMe API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 15 | Microsoft Graph Calendar API +50 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 93 | 10 | Microsoft Graph Calendar API +83 |\n| Agent ergonomics | 13% (16.2 this run) | 88 | 13 | Microsoft Graph Calendar API +75 |\n| Security \u0026 auth | 14% (17.5 this run) | 72 | 24 | Microsoft Graph Calendar API +48 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 30 | Microsoft Graph Calendar API +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 76 | 28 | Microsoft Graph Calendar API +48 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 76 | 61 | Microsoft Graph Calendar API +15 |\n| Negative events | ≤15 | -14 | 0 | |\n| **Total** | | **58.7 · C** | **22.5 · F** | |\n\n## Facts side by side\n\n| Fact | Microsoft Graph Calendar API | YouCanBookMe API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Microsoft | AI Software (Capacity) UK Ltd, trading as YouCanBookMe |\n| Hosted endpoint | `https://graph.microsoft.com/v1.0` | `https://api.youcanbook.me/v1` |\n| Transports | HTTP | HTTP |\n| Auth | OAuth | API key |\n| Pricing | Your plan | Freemium |\n| x402 | no | no |\n| Licence | MIT (SDKs) | none |\n| Tools exposed | 11 | none |\n| Read-only variant documented | no | yes |\n| llms.txt | no | no |\n| Last release | 2026-10-22 | 2026-09-01 |\n| Terms last updated | 2025-10-01 | 2026-03-18 |\n| Privacy policy last updated | 2026-09-01 | 2026-03-16 |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 834 stars, 2.7M npm/wk | none |\n| Agent reviews | 3/5 (2) | none |\n\n## How the scores have moved\n\n### Microsoft Graph Calendar API\n\n- -6.5 on 2 November 2026 (B to C): new evidence, correction\n- +0.1 on 27 October 2026: checklist\n- -0.5 on 8 October 2026: checklist\n\n### YouCanBookMe API\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Microsoft Graph Calendar API.** findMeetingTimes suggests slots across attendees and rooms, getSchedule returns free/busy for many people, and `transactionId` stops a retried create from double-booking. Each app gets four concurrent requests per mailbox. Microsoft published eight Critical, already mitigated CVEs for Exchange Online and Graph in 2026, and the JavaScript client's two security fixes remain unreleased.\n\n**YouCanBookMe API.** A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified.\n\n## Before you call either\n\n### Microsoft Graph Calendar API\n\n1. Send `Prefer: outlook.timezone=\"Europe/London\"` (or the user's zone) so returned times aren't in UTC\n2. Set a `transactionId` on event creates so a retry doesn't double-book\n3. Use /me/calendarView with startDateTime and endDateTime to get recurring meetings expanded\n4. Honour `Retry-After` on 429 and keep to 4 parallel calls per mailbox\n5. Treat event bodies as untrusted input, and ask for Calendars.ReadBasic when you don't need them\n\n### YouCanBookMe API\n\n1. Ask the Account Owner for the account ID and API key, since Administrators and Contributors cannot generate one, and send them as HTTP Basic credentials\n2. Read the API reference at ycbm.stoplight.io in a browser before planning calls; its endpoints and parameters were not readable to us\n3. Treat the key as full account access and keep it out of logs, since no scoped or read-only key is documented\n4. Expect a JSON error body with `code`, `message` and `status` on failures, and check for an existing booking before repeating a create, since no idempotency key is documented\n5. Use booking-page webhooks for booking, reschedule, cancel, reminder, follow-up and no-show events instead of polling\n\n## Questions\n\n### Which is better for AI agents, Microsoft Graph Calendar API or YouCanBookMe API?\n\nMicrosoft Graph Calendar API scores 58.7 (C) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in every scored category.\n\n### Do Microsoft Graph Calendar API and YouCanBookMe API need an API key?\n\nMicrosoft Graph Calendar API uses an OAuth sign-in. YouCanBookMe API needs an API key.\n\n### Can an agent call Microsoft Graph Calendar API and YouCanBookMe API without installing anything?\n\nYes. Microsoft Graph Calendar API has a hosted endpoint at https://graph.microsoft.com/v1.0 and YouCanBookMe API at https://api.youcanbook.me/v1.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.json, and with the fewest tokens: https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"microsoft-graph-calendar\", \"b\": \"youcanbookme\"}`. From a terminal: `anchor compare microsoft-graph-calendar youcanbookme`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/microsoft-graph-calendar.json and https://www.anchorterminal.com/api/v1/tools/youcanbookme.json\n\n## Other comparisons with Microsoft Graph Calendar API or YouCanBookMe API\n\n- [Acuity Scheduling API vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/acuity-scheduling-vs-microsoft-graph-calendar.md)\n- [Agenda Hero vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/agenda-hero-vs-microsoft-graph-calendar.md)\n- [Apiroc Unified Calendar API vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/apiroc-vs-microsoft-graph-calendar.md)\n- [Aurinko Calendar API vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/aurinko-calendar-vs-microsoft-graph-calendar.md)\n- [Cal.com API v2 + MCP vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.md)\n- [Calendly API + MCP vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/calendly-vs-microsoft-graph-calendar.md)\n- [Cozi Family Organizer vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/cozi-vs-microsoft-graph-calendar.md)\n- [Cronofy API vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/cronofy-vs-microsoft-graph-calendar.md)\n- [Google Calendar API vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/google-calendar-api-vs-microsoft-graph-calendar.md)\n- [Microsoft Graph Calendar API vs Nylas Calendar and Scheduler API](https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-nylas-calendar.md)\n- [Microsoft Graph Calendar API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal.md)\n- [Microsoft Graph Calendar API vs Zoom Scheduler API](https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-zoom-scheduler.md)\n- [Acuity Scheduling API vs YouCanBookMe API](https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme.md)\n- [Aurinko Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme.md)\n- [Cal.com API v2 + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.md)\n- [Calendly API + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/calendly-vs-youcanbookme.md)\n- [Cronofy API vs YouCanBookMe API](https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme.md)\n- [Nylas Calendar and Scheduler API vs YouCanBookMe API](https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme.md)\n- [SavvyCal API + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.md)\n- [YouCanBookMe API vs Zoom Scheduler API](https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler.md)\n- [Apiroc Unified Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme.md)\n- [Google Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Microsoft Graph Calendar API vs YouCanBookMe API", "url": "" } ], "description": "Microsoft Graph Calendar scores 58.7 (C) to YouCanBookMe's 22.5 (F) for calendar availability. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Microsoft Graph Calendar API C 58.7", "YouCanBookMe API F 22.5", "scores" ], "h1": "Microsoft Graph Calendar API vs YouCanBookMe API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/microsoft-graph-calendar-vs-youcanbookme", "published": "2026-10-01", "section": "tools", "title": "Microsoft Graph Calendar vs YouCanBookMe for AI agents (2026)", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme" }, "tokens": { "markdown": 5400, "slim": 3330 }, "version": 1 }