Nylas Calendar and Scheduler API vs Truto Unified Calendar API

Nylas Calendar and Scheduler API 88

Changelog entries up to 30 October 2026, the last calendar-specific one on 22 October with event webhook, recurring cancellation and Microsoft availability fixes (30). 20 dated changelog entries between 15 September and 30 October (20). Public dated changelog, open SDK repositories with commits to 30 September (Python) and 13 October (Node), and support (15). Current official SDKs (15). nylas-python v6.18.0 on 30 September 2026. The Node SDK's package.json is still 8.4.0 (24 June 2026) with unreleased commits on main to 13 October (8). 30+20+15+15+8 = 88.

Truto Unified Calendar API 50

No API changelog, so the last API change can't be dated; the official @truto/truto-link-sdk was published as 1.3.5 on 26 October 2026, which we take as the latest dated release (20 of 30, since it is the connection widget, not the calendar API). Six Link SDK versions since 8 August (10 of 20, for the same reason). Support through Slack on paid plans, with no public tracker (5 of 15). A CLI and the Link SDK are official, with no API client (10 of 15). Package health not checked (5 of 10). 20 + 10 + 5 + 10 + 5 = 50.

Nylas Calendar and Scheduler API 85

Nylas IAM, launched 6 October 2026, issues API keys bound to one grant, workspace, application or organisation with roles and permissions. Every new IAM key expires, keys can be disabled or rotated, and the IAM guide (re-read 1 November) shows principals and credentials created and rotated through a public /v3/iam API once a first management key is made in the Dashboard. End users connect through OAuth with scopes the app picks. Application keys still reach every grant, so 1 is held back as for nylas-email, and 1 more because the IAM pages name no calendar permission, as nylas-notetaker holds back for Notetaker (28). A principal can be bound to one grant with read permissions, the agent security page shows a scheduling agent limited to reading calendars and creating events, and anything outside the binding answers 403. The MCP confirmation step covers email sends only, so creating, updating or deleting an event needs no confirmation. 3 below nylas-email's 17, which has the send confirmation (14). The MCP and agent security docs say event descriptions and locations can carry hidden instructions and tell agents to treat calendar content as untrusted (13). IAM Access Activity records allowed and denied API, authentication and MCP requests for 400 days with links to request logs, and Dashboard logs are kept 14 days. Requests made with an application key appear only in the logs (13). SOC 2 Type II, ISO 27001 and 27701, CSA STAR, an annual penetration test and a private bug bounty with security@nylas.com, per the 1 October check, and an RFC 9116 security.txt on developer.nylas.com valid to 1 August 2027. www.nylas.com still has none. nylas-email scores this 17 (17). 28+14+13+13+17 = 85.

Truto Unified Calendar API 52

API tokens are per environment and sent as Bearer headers; no scopes or expiry for them were found (20 of 30). Per-account MCP servers can be limited to read methods or tags and set to expire, and the customer's connection form can restrict access to specific resources, but the REST token reaches every integrated account in its environment (14 of 20). Event titles, descriptions and attendee text from outside parties pass through, and no prompt-injection guidance was found (0). Plans keep request logs 30 or 90 days (10 of 15). SOC 2 is stated in a 2023 blog post, with no trust page, security.txt or disclosure policy found (8 of 20). 20 + 14 + 0 + 10 + 8 = 52.

Nylas Calendar and Scheduler API 82

Closed service under Californian law, with MIT SDKs (15). The privacy policy keeps customer data for the life of the account plus two months and lets EEA customers pick UK or US data centres, per the 1 October check and as nylas-email read it on 1 November. A sub-processor page dated 28 August 2026, with changes announced on the status page (24). v2 deprecation documented and a dated changelog, but no deprecation policy found. The 10 October changelog capped availability ranges at 732 days on the day it took effect (10). Sub-processors listed, AWS and GCP named as hosts, US and EU regions (18). 15+24+10+18 = 67.

Truto Unified Calendar API 61

Closed service under terms naming Yin Yang Inc. (15 of 30). Truto says it stores no customer data and calls vendors live, logs are kept 30 or 90 days by plan, data is kept 15 days after termination, and a DPA is public (25 of 30). Deprecated admin endpoints are marked with no policy or dates (6 of 20). Enterprise customers can choose a data region and tokens can be stored regionally; no subprocessor list was found (8 of 20). 15 + 25 + 6 + 8 = 54.

Nylas Calendar and Scheduler API 40

No x402, MPP or L402 (0). Per-account prices published without login, such as $1.50 a calendar-only account a month on Pro monthly and $1.35 on annual, re-read 1 November (20). Free plan with 5 connected accounts, "No credit card required" (20). Keys can be minted by API, but only after a person makes a first management key in the Dashboard after a browser signup, and each calendar owner completes OAuth (0). 0+20+20+0 = 40.

Truto Unified Calendar API 20

No x402, MPP or L402 (0). Plan prices per connector a year are public, with unlimited calls (10). A free 30-day sandbox is given after a work-email request reviewed within a business day (10 of 20). A person requests access or books a demo (0). 0 + 10 + 10 + 0 = 20.

Nylas Calendar and Scheduler API 91

OpenAPI 3.1 file at developer.nylas.com/openapi.json with 140 paths and 244 operations on 1 November, 20 of the paths and 34 operations for calendars, events, availability and scheduling (25). llms.txt and Markdown docs (10). Guides say when to use each API, and the MCP page lists each tool with a one-line purpose and no when-not-to guidance (15). Typed parameters in the reference (12). An errors page with a JSON shape (type, message, provider_error, request_id) and a retry yes or no for each status code (14). v3 in the path and a dated changelog with 20 entries between 15 September and 30 October 2026 (15). 25+10+15+12+14+15 = 91.

Truto Unified Calendar API 75

An OpenAPI specification is linked from the RFC 9727 API catalogue, but the file timed out and was not read, so it is credited as published and unverified (20 of 25). llms.txt and a Markdown sibling for every page (10). Parameter descriptions say what each does and what it falls back to, such as end_time defaulting to the month of start_time (15 of 20). Types, required marks and allowed values such as focus_time and out_of_office (13 of 15). One documented error shape with provider and Truto fields; few request examples on the reference pages read (12 of 15). Deprecated admin endpoints are marked, but no API changelog was found (5 of 15). 20 + 10 + 15 + 13 + 12 + 5 = 75.

Nylas Calendar and Scheduler API 72

Atlassian Statuspage at status-v3.nylas.com with US and EU components (20). In the 90 days from 3 August the history feed names no calendar incident. Incidents hit IMAP message reads (6 August), US message sync latency (11 August), EWS attachments (14 August), Microsoft send and read through Exchange Online (31 August to 1 September), Notetaker Teams joins (4 September), IMAP retrieval (10 September), IMAP sync (17 September) and Microsoft 365 sign-in for Sandbox applications on shared credentials (from 22 October), each limited to one provider, product or non-production surface, so partial. The exception is 19 August, delayed or missing webhooks for all providers in the US and EU from 09:11 to 14:34 PDT, mitigated by recovering the sync state of affected grants. Calendar event webhooks come from the same provider grant sync, so it counts here as one major, as for nylas-email (10). 200 requests a second per grant for calendar and 50 a second per application for grant, auth and webhook endpoints, plus the provider limits behind them, re-read on 1 November (15). 429s separate Nylas limits from provider limits and pass on the provider's Retry-After, Google's included since 22 October, and the errors page says which codes to retry with exponential backoff. Idempotency keys cover email send only, not event writes (10). The pricing page lists a 99.99 per cent availability SLA for annual Enterprise contracts, with terms in the customer agreement, which nylas-email scores 7 (7). GA (10). 20+10+15+10+7+10 = 72.

Truto Unified Calendar API 77

Graded as a hosted service on the Unified Calendar API. Better Stack status page with components for api.truto.one health, ping and link-token endpoints and the static IP proxy, with incident history (20). The feed lists "APIs and Dashboard are down" on 29 October 2026 and delayed sync jobs and webhooks on 1 November, which counts as one major outage (10). Truto's own limit is 50 requests every 10 seconds per integrated account, in front of each vendor's (15). A vendor 429 comes back with Retry-After and normalised ratelimit-limit, -remaining and -reset headers, with no idempotency guidance for creates (12 of 15). The Enterprise plan lists an SLA guarantee (10). Generally available (10). 20 + 10 + 15 + 12 + 10 + 10 = 77.