Moz API vs SpyFu API

Moz API 50

No downloadable OpenAPI or OpenRPC file is linked from the docs. Each method page carries its payload, result and quota definitions as JSON Schema inside the page itself, drawn into the rendered reference, which we count as a partial contract (8, a judgement call). moz.com/llms.txt returns 404 and no Markdown docs for agents were found (0). Method descriptions state the purpose and the row cost, and the guides explain async calls, errors and the new webhooks, but few say when not to use a method (10). Inputs are typed with enums for scope, sort, filters, engine and device, numeric ranges and required fields, per the 8 October check (13). Request and response examples appear on each method page and in cURL, Python and JavaScript, and the error guide lists 13 codes with sample bodies (14). The docs say the API is not versioned, and the product updates archive holds one dated Moz API entry in the last 90 days, the MCP beta of 14 August (5). 8 + 0 + 10 + 13 + 14 + 5 = 50.

SpyFu API 75

Every reference page embeds an OpenAPI 3.1 definition with security schemes and responses, but no single downloadable file is linked (20 of 25). llms.txt and a Markdown twin of every page (10). Descriptions say what each endpoint returns and how it differs from its neighbours ('unlike term-based endpoints...') (17 of 20). Typed parameters with descriptions, examples and required flags (12 of 15). 200, 400, 401 and 500 in the definitions and a 429 example, little on error bodies (11 of 15). v2 in every path, but no changelog (/changelog answered 404) (5 of 15). 20+10+17+12+11+5 = 75.

Moz API 60

Editorial half only. Terms, General Conditions and privacy policy re-read on 5 November, unchanged. Closed service with clear terms, the API General Conditions (effective 12 August 2026) and an API legal page with attribution rules (15). The privacy policy (effective 8 April 2025) has a table of retention periods by data category and describes transfers under the EU-U.S. Data Privacy Framework, but covers the whole Moz site. No data processing agreement and no statement on retention of API queries were found on the pages reviewed (15). The docs say no breaking changes are expected outside beta methods, while the terms let Moz change or discontinue the service without notice, and the note that some methods are documented only in the legacy docs carries no dates (5). No list of subprocessors or data locations was found. The privacy policy says data is shared with other Ziff Davis companies (4). 15 + 15 + 5 + 4 = 39.

SpyFu API 38

Closed service under terms naming SpyFu, Inc., updated 25 February 2019, under Arizona law (15 of 30). The privacy policy carries no date, retention periods, controller or named processors, and says data is moved to the United States (5 of 30). No deprecation policy or notices found (0 of 20). No subprocessors named; data location is the United States (3 of 20). 15+5+0+3 = 23.

Moz API 38

Plain revocable tokens, up to five per account, sent in the x-moz-token header and never in a URL. No scopes were found. The beta MCP server adds OAuth with PKCE and dynamic client registration, with a single scope named mcp (20). The Data methods only read, but there's no read-only or per-product token, and the MCP guide says the same token works on the Local endpoint, whose methods create, update, cancel and close locations (8). Results carry page titles, anchor text and search result snippets from the open web, and no prompt-injection guidance was found (0). Each response reports the quota used and the dashboard has a usage page behind a login we couldn't read. No audit log was found in the docs (5). security.txt gives a contact address, but on 5 November it carried Expiration: 2026-11-04T15:27:33-08:00, about three hours before our read, as on 8 October, and its policy page still returns 404. No SOC 2 or ISO 27001 statement and no bug bounty were found (5). 20 + 8 + 0 + 5 + 5 = 38.

SpyFu API 52

An API ID and secret key, sent by Basic auth or by a timestamped HMAC signature, with no scopes found (22), less 10 for the documented api_key query parameter (12 of 30). The API only reads (15 of 20). Ad copy, page titles and SERP data are third-party text, with no prompt-injection guidance (5 of 15). The Account API reports usage by month, day and method (12 of 15). A vulnerability disclosure policy with safe harbour and response targets; security.txt returns 404 and no certification or bug bounty was found (8 of 20). 12+15+5+12+8 = 52.

Moz API 28

The newest dated Moz API entry in the product updates archive is the MCP server beta of 14 August 2026, 83 days before this check (20). That is the only Moz API entry in the last 90 days. The 22 and 28 October entries cover Moz AI Explorer and Moz Data in Profound, which record no API change, and a webhooks guide for Moz Local Enterprise carries no date (0). A dated archive exists, and support is by api@moz.com and the help team contact form, with 24/7 online support claimed on the product page. We could not test response times, and the contact page returned 403 to our reader on 8 October (8). No official SDK was found (0). No packages to assess (0). 20 + 0 + 8 + 0 + 0 = 28.

SpyFu API 16

Closed service. No changelog. The newest dated docs change found is 13 July 2026 (the rate-limits and pricing pages' updatedAt), 116 days before this check (10). Reference pages are dated between August 2025 and 9 July 2026, so fewer than three dated changes in 90 days (0). A help centre and support email, with no public changelog or tracker (6 of 15). No official SDK (0). No package to judge (0). 10+0+6+0+0 = 16.

Moz API 74

List methods take limit (1 to 50 on link lists) and separate methods return a single keyword metric, but no field selection was found, and a site metrics object carries about 60 fields (15). Paging by opaque token, sort keys and named filters such as external, follow and gained_last_60_days (20). Errors carry a stable code, HTTP status, data.issue, data.key and an explanation, though the status field is named status in some bodies and httpStatus in others (19). The Data methods are reads, validation and quota checks run before any rows are used, and async calls can be polled again, but no idempotency keys were found for the Local write methods (13). site_query is the only required input on most site methods, the request id must be at least 24 characters, and no official SDK was found in the reviewed documentation (7). 15 + 20 + 19 + 13 + 7 = 74.

SpyFu API 65

Rows are billed, so page size controls cost; single or multiple rows per request by endpoint, and searchType selects analyses on one endpoint (18 of 25). Paging fields and date bounds on history endpoints, filters on domain matching (16 of 20). 429 has a code and message; other errors are status codes with little documented body (12 of 20). All GET reads, safe to retry (14 of 20). No official SDK found (5 of 15). 18+16+12+14+5 = 65.