Plivo API vs YCloud

Plivo API 59

No OpenAPI spec found (0). llms.txt at plivo.com/docs/llms.txt (10). Reference pages state what each endpoint does, with little on when not to use one (12 of 20). Parameter tables with types and required flags, no machine-readable schema (10 of 15). Examples in each SDK language. We didn't recheck the messaging error list this run (12 of 15). Versioned v1 path and a public changelog (15).

YCloud 90

OpenAPI 3.0 file for API v2 (45 paths) and a legacy v1 file, public on docs.ycloud.com (25). llms.txt and Markdown pages (10). Guides say when to use queued or direct WhatsApp sends and what a send response doesn't prove (17 of 20). 238 enums in the spec (14 of 15). Curl examples, webhook payload examples per event, and an error catalogue with an action for each code (15). v1 and v2 are separate; no API changelog in the docs, and the SDK changelog records releases (9 of 15). 25 + 10 + 17 + 14 + 15 + 9 = 90.

Plivo API 57

List endpoints take limit and offset, with no field selection (15 of 25). Message list filters weren't rechecked this run (15 of 20). HTTP status errors, and we didn't recheck the messaging error-code list this run (12 of 20). No idempotency key or safe-retry guidance for sends found (0 of 20). Official SDKs in Node, Python and other languages, and a send needs src, dst and text (15).

YCloud 83

List endpoints use a documented pagination guide with limits; send responses are small (18 of 25). Pagination and filters (18 of 20). Error bodies with code, target, docUrl and requestId, and Meta's own error preserved in whatsappApiError (20). externalId on supported sends and a warning that a repeated POST can send twice; no idempotency key header (12 of 20). A send needs a recipient and content; official SDKs for Node.js, Java, Go and PHP (15). 18 + 18 + 20 + 12 + 15 = 83.

Plivo API 50

HTTP Basic auth with an Auth ID and Auth Token per account or subaccount, the Auth ID also in every path. No per-key scopes found (20). Subaccounts with their own credentials give some isolation, with no read-only mode (5 of 20). Inbound SMS and WhatsApp bodies are untrusted text. Webhooks are signed, and we found no prompt-injection guidance (5 of 15). Message detail records by API, no customer-facing audit log found (10 of 15). SOC 2 audited annually, PCI DSS Level 1 and HIPAA per the security page. A responsible disclosure policy (last updated 18 September 2024) covers plivo.com and Plivo's products and sends reports to security@plivo.com; the 1 October check missed it. No security.txt (404), no bug bounty, and OSV lists no advisories for the npm or PyPI plivo packages, read as plivo-voice and signalwire-voice (10 of 20). 20 + 5 + 5 + 10 + 10 = 50.

YCloud 31

One API key in the X-API-Key header, never in the URL, rotated by creating a new key and revoking the old one; no scopes found (20 of 30). Trial accounts send only to pre-verified numbers; no read-only key or approval step (4 of 20). Inbound WhatsApp and SMS text arrives through webhooks, with no prompt-injection guidance (0 of 15). Every response carries a request ID; no operator request log was found in the docs (5 of 15). No certification is named on the pages read, the about page shows an unlabelled ISO image, and there is no security.txt or disclosure policy (2 of 20). 20 + 4 + 0 + 5 + 2 = 31.

Plivo API 71

Closed service with clear terms at plivo.com/legal/tos (15). Privacy policy, encryption at rest and in transit, and a sub-processor list. We didn't find a DPA or message-log retention periods (20 of 30). No deprecation policy or dated notices found (0). About 40 sub-processors listed with purpose and location (all USA), last updated 2025-08-13, with no change alerts (15 of 20).

YCloud 53

Closed service with terms of 3 September 2026 that don't name the contracting entity; the about page names YCloud International Pte. Ltd. The Node SDK is MIT (12 of 30). The privacy policy (3 April 2026) gives no retention periods, mentions no DPA and says the primary servers are in Singapore (8 of 30). The terms promise reasonable notice of changes only to those who subscribe to it; v1 is kept as legacy (7 of 20). No sub-processor list; the data location is named (5 of 20). 12 + 8 + 7 + 5 = 32.

Plivo API 90

Statuspage at status.plivo.com with components and a readable history feed (20). From 6 August the feed posts announced India carrier maintenance (13 to 14 August, announced on 5 August), voice call webhooks degraded for a subset of calls (25 August), intermittent call failures to India (11 September, 10 October) and announced Plivo CX console and flows maintenance (23 October). None touches messaging, so a clean record for this listing (30). API limit published, 300 requests per 5 seconds, with a 429 above it (15). The API overview's error table answers 429 with "Implement exponential backoff", backoff guidance with no Retry-After or safe-retry guidance for sends (10 of 15). Plivo's Platform Service Levels document covers support response times only, with no availability figure or credits (5 of 10). Messaging API is generally available (10). 20 + 30 + 15 + 10 + 5 + 10 = 90.

YCloud 79

Read with the hosted lines. status.ycloud.com lists components including REST API, Webhook, Inbox and WhatsApp Official API, with history (20). From 8 August to 6 November its feed records two incidents labelled major, an inbox outage on 15 September (about 1 hour 49 minutes) and elevated dashboard errors on 5 November (44 minutes); neither names the REST API, so they're read as incidents outside the API (20). Limits with numbers per endpoint, account and sender (15). 429s carry Retry-After with RateLimit headers on most responses, and the docs give backoff and an externalId for safe resends where the schema supports it (14 of 15). No SLA; the terms say availability can't be guaranteed (0). API v2 is generally available (10). 20 + 20 + 15 + 14 + 0 + 10 = 79.

Plivo API 40

No x402, MPP or L402 (0). US per-message SMS and MMS prices, carrier surcharges by carrier and number rental are published without a login (20). Free credits with no card, per the pricing page (20). A person signs up in a browser and verifies a phone number (0).

YCloud 35

No x402, MPP or L402 (0). Plan prices public, WhatsApp at Meta's rate with no markup and email at $0.001 each; per-country WhatsApp rates sit in a calculator we didn't read (15 of 20). The Free plan includes the messaging API with no card (20). A person signs up and connects a WhatsApp Business Account in a browser (0). 0 + 15 + 20 + 0 = 35.