Node-RED vs Prismatic

Node-RED

Node-RED's Admin HTTP API covers flows, nodes and settings in 20 documented methods, with read and write permissions per resource and a revision check on deploys. It has no OpenAPI file, no pagination and no SDK, and a default install accepts API calls from anyone who can reach port 1880.

Prismatic

The GraphQL API covers 120 queries and 124 mutations with typed inputs, cursor pagination and Markdown documentation, and tokens follow seven user roles. No price is published, paid use runs under an agreement that is not public, and no API rate limit or idempotency key was found in the reviewed documentation.

Node-RED

1. Call GET /auth/login first. An empty object means no authentication is set and every Admin API call is open
2. Send Node-RED-API-Version: v2 and the last rev on POST /flows, and re-read the flows on a 409
3. Set Node-RED-Deployment-Type to nodes or flows to restart only what changed. The default full stops every node
4. Prefer GET /flow/:id and PUT /flow/:id for one tab. GET /flows returns every node in the runtime
5. Treat flows.write and nodes.write as code execution on the host. Function nodes run JavaScript and POST /nodes installs npm modules

Prismatic

1. Have a person run prism login once, then store the output of prism me:token --type refresh as PRISM_REFRESH_TOKEN. Access tokens last 7 days
2. Read the errors array on every mutation. A failed mutation still returns HTTP 200
3. Pass sortBy with CREATED_AT when paging. Without a sort order pages can repeat or skip records
4. Use the regional host for the tenant, such as app.eu-west-1.prismatic.io and mcp.eu-west-1.prismatic.io
5. Create a guest user for a read-only agent, because tokens have no scopes of their own