OpenAI Realtime API vs Vaani Developer Platform

OpenAI Realtime API 90

Closed service with clear terms, per the OpenAI API listing's check of the services agreement, which answered 403 to our reader again on 2 November. The Agents SDK for TypeScript and the OpenAPI file are MIT (15, was 10). The data controls page, re-read on 2 November, lists /v1/realtime with no training use, abuse monitoring logs kept up to 30 days, no stored application state and Zero Data Retention eligibility. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 2 November. The same reading as the other OpenAI listings (30, was 18). The deprecations page, re-read on 2 November, states at least six months' notice for generally available models and lists shutdown dates with replacements, including gpt-realtime and gpt-realtime-mini on 20 January 2027 (20). The guide documents residency for /v1/realtime in the United States and Europe for storage and processing, with a sip-eu.api.openai.com endpoint, and says tracing on /v1/realtime isn't EU residency compliant. The subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries for each and a form for notice of new ones, per the OpenAI API listing's 4 October check, not re-read on 2 November. The guide states the residency limit, which counts as disclosure, so the same reading as the other OpenAI listings (20, was 10). 15 + 30 + 20 + 20 = 85.

Vaani Developer Platform 42

A closed service. The terms name Vaani AI Research Private Limited, its Bengaluru address, CIN, Indian law and Bengaluru courts, but they're undated, written for the website www.vaaniresearch.com, and say nothing on billing, refunds, API use or customer data. The SDK and MCP server are MIT, with the SDK's full source in its PyPI sdist (14 of 30). The privacy policy (undated) keeps data, including voice recordings, for up to 24 months, while the pricing table gives 30 days' retention on pay as you go and zero retention on Enterprise. Voice data trains models only with explicit consent. No DPA found (8 of 30). No deprecation policy. The privacy policy promises 15 days' notice of significant changes, and the terms allow changes and termination without notice (2 of 20). The privacy policy names vendor categories (cloud hosting, analytics, voice transcription) and says data may be stored outside India. Model and telephony providers can be read from the calculator, and India data residency is offered on demand. No subprocessor list or data location for the hosted service (5 of 20). 14+8+2+5 = 29.

OpenAI Realtime API 83

Server connections send the API key as a Bearer header. Browsers use client secrets from POST /v1/realtime/client_secrets that last 10 seconds to 2 hours, 10 minutes by default, and can open several sessions until expiry, and the browser WebSocket example passes the secret as a subprotocol, not in the query string. Project keys take All, Restricted or Read Only permissions, with service accounts, workload identity federation and mutual TLS, per the OpenAI API listing's check. The permissions guide, read on 2 November, puts /v1/realtime under one Model capabilities permission with chat completions, audio, embeddings, images, moderations and responses, so a restricted key can't be limited to Realtime alone (27 of 30, as the OpenAI Speech-to-text listing, was 24 when key scopes were unread). MCP tools take allowed_tools and require_approval, which defaults to always in the OpenAPI file, and a sideband connection keeps tool execution on the server. Session settings attached to a client secret can be overridden by the client connection (15 of 20). The model hears callers and reads MCP results. The SIP guide says to treat SIP headers as untrusted, and no prompt-injection guidance specific to Realtime was found, per the 9 October check (6 of 15). The Admin APIs include audit log retrieval, and since 4 August 2026 the Usage and Costs dashboards and APIs filter and group by API key, the per-key view the other OpenAI listings get 15 for. The Usage API has no Realtime-specific endpoint (15, was 10). openai.com's security.txt, read on 2 November, is PGP-signed with a Bugcrowd programme, a disclosure email and a coordinated disclosure policy, and has no Expires field. trust.openai.com, read on 2 November, names SOC 2 Type 2, ISO/IEC 27001, 27017, 27018, 27701 and 42001 and CSA STAR (20, was 6 when openai.com refused our reader, the award the other OpenAI listings carry). 27 + 15 + 6 + 15 + 20 = 83.

Vaani Developer Platform 44

Plain revocable API keys, shown once, several active at a time and rotated by creating a new key and deleting the old one. Every key reaches the whole workspace, with no scoped, read-only or per-agent keys (20). Campaign webhooks are signed with HMAC-SHA256 over a timestamp and the body, with a five-minute replay window in the example (+2). The live-captions URL carries a call-bound token in the query string for 24 hours by default, the documented way for browsers to connect, so 3 off as a judgement call, less than the full 10 because it isn't the account key (19 of 30). The MCP server has a read-only mode and destructive annotations, and its docs, tool descriptions and bundled prompt say to confirm the number and agent with the user before a call. The API itself has no read-only key and nothing stops a call without confirmation (12 of 20). The tool returns transcripts, summaries and entities drawn from callers' speech. No guidance on treating them as untrusted data was found. Agent guardrails exist for the voice agent's own replies (3 of 15). Each call keeps a record in call history and call details, and keys are labelled so calls can be traced to a key, but no account or key audit log is documented (7 of 15). No security.txt (404 on both domains), disclosure policy, bug bounty or certification. vaaniresearch.com marks its security standards "In Progress", the pricing page lists HIPAA compliance on Enterprise with no report or BAA found, and the privacy policy promises breach notice in line with applicable law (3 of 20). 19+12+3+7+3 = 44.

OpenAI Realtime API 62

Graded as a hosted API. status.openai.com (incident.io) lists Realtime as a component of the API group with history (20). The feed, read on 2 November (102 items, 4 August to 30 October), names Realtime in three incidents in the 90 days from 4 August, and each incident page gives the component's impact. Elevated error rates across API models on 17 September, with Realtime degraded from 20:20 to 21:20 UTC alongside ten other API components, and elevated errors across ChatGPT, Codex and the API on 29 September, with Realtime degraded from 17:52 to 23:14 UTC, are each an hour or more of wide errors, so two majors. Degraded performance across ChatGPT, Codex and the APIs on 21 October listed Realtime for 22 minutes (02:26 to 02:48 UTC), so minor. The 11 August incident on the API, Codex and Work Mode lists no components and isn't counted, as on the other OpenAI listings, and the July incidents the 9 October check counted have left the window. Two majors give 5, as the OpenAI API, Moderation, Embeddings and Speech-to-text listings read the same two incidents (5 of 30, was 20 when the durations were unread). The gpt-realtime-2.1 model page, read on 2 November, gives 400 requests and 200,000 tokens a minute on Build, 10,000 and 4 million on Launch and 20,000 and 15 million on Grow (15, was 5 when the limits were known only from account settings). The docs describe Retry-After on 429 and 503, exponential backoff with jitter and SDK retries, sessions emit rate_limits.updated, and SIP webhooks carry a webhook-id for deduplication, per the 9 October check. No idempotency key for call control was found, so safe-retry guidance without keys (12 of 15). No SLA covering Realtime was found, read as on the other OpenAI listings, where the Scale Tier SLA names GPT and o-series models (0). Generally available since 28 August 2025 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.

Vaani Developer Platform 28

Graded on the hosted REST API at api.vaanivoice.ai. No status page. status.vaani.dev and status.vaanivoice.ai don't resolve, and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits are published. The docs give 2 concurrent calls on pay as you go and a per-organisation campaign concurrency cap, so partial credit (5). The SDK raises RateLimitError on 429 and the MCP client retries once after 600 ms, but no Retry-After, backoff guidance or idempotency key for call creation is documented (3). The pricing table lists a 99.50 per cent uptime SLA on both plans, but no SLA document or service credits were found and the terms supply the service "as-is" with no warranties, so half (5). The API is version 2.0.0 and isn't labelled beta (10). 0+5+5+3+5+10 = 28.

OpenAI Realtime API 84

The OpenAPI 3.1 file in openai/openai-openapi (version 2.3.0, last committed 31 October 2026, read from a clone on 2 November) has nine /realtime paths and 185 Realtime schemas, with 11 client events and 46 server events in its main event unions and separate translation session events. It is not an AsyncAPI document, so the WebSocket channel itself is not described (22 of 25). llms.txt and a Markdown twin of every docs page, re-read on 2 November (10). The tools guide has a table of when to use function, mcp with server_url or a connector, and the transport guides say when to choose WebRTC, WebSocket or SIP, per the 9 October check (16 of 20). Session fields carry enums and ranges, such as expires_after.seconds from 10 to 7200, though model also accepts any string (13 of 15). Examples in JavaScript, Python, Java, Ruby and C#, an error event with type, code, message and param, and a list of common MCP failures. No catalogue of Realtime error codes was found (11 of 15). Dated changelog and dated snapshots for the older models (gpt-realtime-2.1 lists only its alias), less 3 because the OpenAPI file still names gpt-4o-realtime-preview models (12 mentions on 2 November) that the deprecations page says were removed on 7 May 2026, and several guides mix GPT-Live and Realtime text on one page (12 of 15). 22 + 10 + 16 + 13 + 11 + 12 = 84.

Vaani Developer Platform 57

A public OpenAPI 3.1 file at docs.vaani.dev/api-reference/openapi.json, version 2.0.0, but it holds 5 of the 24 operations in the API reference (trigger-call, call history, transcript, stream, call details). It declares the key only as a header parameter with no security scheme, its trigger-call schema leaves out medium and modify_agent, and four response schemas are empty. The MCP tools have typed zod inputs (8 of 25). llms.txt, llms-full.txt and a Markdown copy of each page on Mintlify (10). Pages explain what each route is for and warn where it matters, such as dispatch acceptance not meaning a completed call, transcripts returning 404 while processing, and real paid calls from trigger_call (14 of 20). Ranges and enums are documented (medium, voice_speed 0.6 to 1.4, page_size up to 200, campaign retries 1 to 10, campaign status), but metadata, modify_agent and three MCP tool payloads are free-form objects (9 of 15). Request examples in cURL, Python and JavaScript on every endpoint, a campaign error-code table, 422 and 404 bodies and an SDK exception table by status. No single error reference for the whole API (12 of 15). The docs state API version 2.0.0, but no changelog or release notes page was found (4 of 15). 8+10+14+9+12+4 = 57.

OpenAI Realtime API 82

The last dated changelog entry tagged v1/realtime is the 26 August 2026 deprecation of whisper-1, gpt-4o-transcribe and two related models, which Realtime sessions can use for input transcripts, after gpt-transcribe for committed Realtime turns on 28 July. The listing's own package, @openai/agents-realtime, released 0.21.0 on 20 October 2026, 13 days before the check, with Realtime fixes (WebRTC connections rejected when the server reports an error before the session is configured, Twilio audio defaults kept), read from a clone. A release that changes the product's own package sets the recency line in this run (30, was 20 when SDK releases weren't read on this line). In the 90 days from 4 August the changelog has one v1/realtime entry and the SDK has 11 version tags, 0.14.3 on 5 August to 0.21.0, at least seven of which change the Realtime package's source. SDK tags count half, so 1 + 3.5 clears three (20, was 0). Closed service with a changelog updated several times a week, plus a community forum and Discord linked from the docs, which we did not test (10 of 15). Current official SDKs, @openai/agents and @openai/agents-realtime 0.21.0 (15). The SDK is MIT but still 0.x, and its CI results were not read (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

Vaani Developer Platform 59

vaani-research-mcp 0.1.1 on 2026-10-14 (30). In the last 90 days, vaani-sdk 0.3.1 on 28 September and three npm versions (0.0.0-stage, 0.1.0, 0.1.1) within 40 minutes on 14 October. No dated changelog, so half (10 of 20). A closed service with no public changelog, issue tracker or community channel found. Contact is hello@vaaniresearch.com and a booking link, and we didn't test whether they answer. The MCP repository on GitHub couldn't be read from this session (4 of 15, the closed-service reading). A current official Python SDK, released seven times since April 2026. The MCP server isn't in the official MCP registry (10 of 15). The SDK's sdist ships its tests and current httpx and pydantic dependencies, and the MCP package runs its tests before publishing, but no public CI was found and the SDK has no repository (5 of 10). 30+10+4+10+5 = 59.

OpenAI Realtime API 76

Read on the API lines, per the 9 October check of the guides, not re-read on 2 November. Context can be capped with truncation, retention_ratio and token_limits.post_instructions, items can be deleted, prompt caching is automatic, and response.done reports token usage by modality (22 of 25). There are no lists to page. Output controls are output_modalities, max_output_tokens, optional input transcription and allowed_tools (14 of 20). The error event returns the event_id of the client event that caused it, and MCP tool listing and calls have their own failure events (15 of 20). Client events take an event_id, webhooks carry a webhook-id, and interruptions cancel the response. No session resumption after a dropped connection and no idempotency key for call control were found (10 of 20). A session needs only a model, voice activity detection is automatic, and the Agents SDK starts a browser voice agent in about ten lines, with examples in five languages (15). 22 + 14 + 15 + 10 + 15 = 76.

Vaani Developer Platform 64

The local MCP server loads 9 compact tools, and VAANI_READ_ONLY=true leaves 3. Transcripts are cut at 20,000 characters by default with a note. The REST API has no field selection or summaries, so 3 off (22 of 25). Call history pages by page and page_size up to 200 with no filters. The MCP agent filter runs client-side on one page. Agents filter by search and published_only and campaigns by status (12 of 20). Campaign errors carry a machine-readable code, a message, the path and a request_id (shown as "unknown" in the example). Validation errors list the field location, the SDK maps each status to a typed exception including 402 for a low wallet, and the MCP server adds a hint per status (15 of 20). All 9 MCP tools carry readOnlyHint, destructiveHint and idempotentHint, with trigger_call and campaign_action marked destructive. No idempotency key on trigger-call, and the MCP client retries a POST once after a timeout or 5xx, so a call can be placed twice. The webhook docs say to deduplicate by event id (8 of 20). A call needs agent_id, contact_number and name, with medium defaulting to telephony. One official SDK, Python, sync and async. The npm package is an MCP server, not an SDK (7 of 15). 22+12+15+8+7 = 64.