Nylas Calendar and Scheduler API vs YouCanBookMe API

Nylas Calendar and Scheduler API 91

OpenAPI 3.1 file at developer.nylas.com/openapi.json with 140 paths and 244 operations on 1 November, 20 of the paths and 34 operations for calendars, events, availability and scheduling (25). llms.txt and Markdown docs (10). Guides say when to use each API, and the MCP page lists each tool with a one-line purpose and no when-not-to guidance (15). Typed parameters in the reference (12). An errors page with a JSON shape (type, message, provider_error, request_id) and a retry yes or no for each status code (14). v3 in the path and a dated changelog with 20 entries between 15 September and 30 October 2026 (15). 25+10+15+12+14+15 = 91.

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Nylas Calendar and Scheduler API 85

Nylas IAM, launched 6 October 2026, issues API keys bound to one grant, workspace, application or organisation with roles and permissions. Every new IAM key expires, keys can be disabled or rotated, and the IAM guide (re-read 1 November) shows principals and credentials created and rotated through a public /v3/iam API once a first management key is made in the Dashboard. End users connect through OAuth with scopes the app picks. Application keys still reach every grant, so 1 is held back as for nylas-email, and 1 more because the IAM pages name no calendar permission, as nylas-notetaker holds back for Notetaker (28). A principal can be bound to one grant with read permissions, the agent security page shows a scheduling agent limited to reading calendars and creating events, and anything outside the binding answers 403. The MCP confirmation step covers email sends only, so creating, updating or deleting an event needs no confirmation. 3 below nylas-email's 17, which has the send confirmation (14). The MCP and agent security docs say event descriptions and locations can carry hidden instructions and tell agents to treat calendar content as untrusted (13). IAM Access Activity records allowed and denied API, authentication and MCP requests for 400 days with links to request logs, and Dashboard logs are kept 14 days. Requests made with an application key appear only in the logs (13). SOC 2 Type II, ISO 27001 and 27701, CSA STAR, an annual penetration test and a private bug bounty with security@nylas.com, per the 1 October check, and an RFC 9116 security.txt on developer.nylas.com valid to 1 August 2027. www.nylas.com still has none. nylas-email scores this 17 (17). 28+14+13+13+17 = 85.

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Nylas Calendar and Scheduler API 88

Changelog entries up to 30 October 2026, the last calendar-specific one on 22 October with event webhook, recurring cancellation and Microsoft availability fixes (30). 20 dated changelog entries between 15 September and 30 October (20). Public dated changelog, open SDK repositories with commits to 30 September (Python) and 13 October (Node), and support (15). Current official SDKs (15). nylas-python v6.18.0 on 30 September 2026. The Node SDK's package.json is still 8.4.0 (24 June 2026) with unreleased commits on main to 13 October (8). 30+20+15+15+8 = 88.

YouCanBookMe API 28

Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.

Nylas Calendar and Scheduler API 71

38 MCP tools with no toolsets found on 1 November (5), plus 5 for limit and select field selection on the REST API (10). Page tokens and time filters on event lists (18). Typed errors with a request ID and a provider error passed through, and a retry table (18). The MCP needs a confirmation call before sending mail, but event create, update and delete need none, event writes have no idempotency key and we found no tool annotations (10). Official SDKs in Node, Python and more (15). 10+18+18+10+15 = 71.

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Nylas Calendar and Scheduler API 72

Atlassian Statuspage at status-v3.nylas.com with US and EU components (20). In the 90 days from 3 August the history feed names no calendar incident. Incidents hit IMAP message reads (6 August), US message sync latency (11 August), EWS attachments (14 August), Microsoft send and read through Exchange Online (31 August to 1 September), Notetaker Teams joins (4 September), IMAP retrieval (10 September), IMAP sync (17 September) and Microsoft 365 sign-in for Sandbox applications on shared credentials (from 22 October), each limited to one provider, product or non-production surface, so partial. The exception is 19 August, delayed or missing webhooks for all providers in the US and EU from 09:11 to 14:34 PDT, mitigated by recovering the sync state of affected grants. Calendar event webhooks come from the same provider grant sync, so it counts here as one major, as for nylas-email (10). 200 requests a second per grant for calendar and 50 a second per application for grant, auth and webhook endpoints, plus the provider limits behind them, re-read on 1 November (15). 429s separate Nylas limits from provider limits and pass on the provider's Retry-After, Google's included since 22 October, and the errors page says which codes to retry with exponential backoff. Idempotency keys cover email send only, not event writes (10). The pricing page lists a 99.99 per cent availability SLA for annual Enterprise contracts, with terms in the customer agreement, which nylas-email scores 7 (7). GA (10). 20+10+15+10+7+10 = 72.

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Nylas Calendar and Scheduler API 82

Closed service under Californian law, with MIT SDKs (15). The privacy policy keeps customer data for the life of the account plus two months and lets EEA customers pick UK or US data centres, per the 1 October check and as nylas-email read it on 1 November. A sub-processor page dated 28 August 2026, with changes announced on the status page (24). v2 deprecation documented and a dated changelog, but no deprecation policy found. The 10 October changelog capped availability ranges at 732 days on the day it took effect (10). Sub-processors listed, AWS and GCP named as hosts, US and EU regions (18). 15+24+10+18 = 67.

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.