Nominatim vs Woosmap

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Woosmap 81

OpenAPI 3.1 spec, version 1.46.3, with 47 paths across Localities, Stores, Distance, Datasets, Indoor, Map and what3words endpoints (25). llms.txt as a routing index, llms-full.txt and a Markdown twin of every page (10). llms.txt says which pages are authoritative for parameters and which explain products, and endpoint pages describe purpose, with little on when not to call one (15). Typed parameters from the spec with enums and required fields (13). The spec documents 400, 401, 402, 403, 404, 409, 422 and 429 responses, and pages carry examples (13). The spec is versioned, but no public changelog or release notes were found (developers.woosmap.com/changelog/ and /release-notes/ return 404) (5). 25+10+15+13+13+5 = 81.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Woosmap 30

No x402, MPP or L402 (0). Plans and per-API tier breakpoints are public, but per-request prices sit in a script-driven calculator we couldn't read, so plan-only credit (10). Free plan up to 10,000 requests a month with 'No Credit Card Required' (20). A person signs up and creates a key in the console (0). 0+10+20+0 = 30.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

Woosmap 54

Editorial half only. Closed service under online terms that name WOOSMAP SAS of Montpellier and the Commercial Court of Paris (15). The privacy policy covers website visitors only, and we found no statement on how long API request data is kept (5). The pricing page says the Address API is 'being deprecated for Pro Plan subscriptions', with no date (5). The legal notice says the site is hosted by Amazon Web Services; no sub-processor list or data location for the APIs was found (6). 15+5+5+6 = 31.