Plivo API vs Prelude

Plivo API 59

No OpenAPI spec found (0). llms.txt at plivo.com/docs/llms.txt (10). Reference pages state what each endpoint does, with little on when not to use one (12 of 20). Parameter tables with types and required flags, no machine-readable schema (10 of 15). Examples in each SDK language. We didn't recheck the messaging error list this run (12 of 15). Versioned v1 path and a public changelog (15).

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

Plivo API 71

Closed service with clear terms at plivo.com/legal/tos (15). Privacy policy, encryption at rest and in transit, and a sub-processor list. We didn't find a DPA or message-log retention periods (20 of 30). No deprecation policy or dated notices found (0). About 40 sub-processors listed with purpose and location (all USA), last updated 2025-08-13, with no change alerts (15 of 20).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

Plivo API 57

List endpoints take limit and offset, with no field selection (15 of 25). Message list filters weren't rechecked this run (15 of 20). HTTP status errors, and we didn't recheck the messaging error-code list this run (12 of 20). No idempotency key or safe-retry guidance for sends found (0 of 20). Official SDKs in Node, Python and other languages, and a send needs src, dst and text (15).

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

Plivo API 90

Statuspage at status.plivo.com with components and a readable history feed (20). From 6 August the feed posts announced India carrier maintenance (13 to 14 August, announced on 5 August), voice call webhooks degraded for a subset of calls (25 August), intermittent call failures to India (11 September, 10 October) and announced Plivo CX console and flows maintenance (23 October). None touches messaging, so a clean record for this listing (30). API limit published, 300 requests per 5 seconds, with a 429 above it (15). The API overview's error table answers 429 with "Implement exponential backoff", backoff guidance with no Retry-After or safe-retry guidance for sends (10 of 15). Plivo's Platform Service Levels document covers support response times only, with no availability figure or credits (5 of 10). Messaging API is generally available (10). 20 + 30 + 15 + 10 + 5 + 10 = 90.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

Plivo API 50

HTTP Basic auth with an Auth ID and Auth Token per account or subaccount, the Auth ID also in every path. No per-key scopes found (20). Subaccounts with their own credentials give some isolation, with no read-only mode (5 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed, and we found no prompt-injection guidance (5 of 15). Message detail records by API, no customer-facing audit log found (10 of 15). SOC 2 audited annually, PCI DSS Level 1 and HIPAA per the security page. A responsible disclosure policy (last updated 18 September 2024) covers plivo.com and Plivo's products and sends reports to security@plivo.com; the 1 October check missed it. No security.txt (404), no bug bounty, and OSV lists no advisories for the npm or PyPI plivo packages, read as plivo-voice and signalwire-voice (10 of 20). 20 + 5 + 5 + 10 + 10 = 50.

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

Plivo API 40

No x402, MPP or L402 (0). US per-message SMS and MMS prices, carrier surcharges by carrier and number rental are published without a login (20). Free credits with no card, per the pricing page (20). A person signs up in a browser and verifies a phone number (0).

Prelude 30

No x402, MPP or L402 (0). Per-verification price (€0.032) and per-message Notify prices published without login (20). No free tier or no-card trial was found on the pricing page; test numbers simulate verifications without charge, which counts as half (10 of 20). A person signs up in the dashboard (0). 0 + 20 + 10 + 0 = 30.