Qovia vs Zyte API

Qovia 40

Hosted reading, for the REST API with the MCP server described. No public status page was found. https://qovia.ai/status/ answers 404, status.qovia.ai does not resolve and neither the docs nor the footer links one (0). No readable incident history, so 5 by the rubric (5). Limits are published with numbers on the quickstart's rate-limits section, 60 requests a minute per account before the first top-up and 600 after on a sliding 60-second window, with X-RateLimit-Limit and X-RateLimit-Remaining headers, a 64 KiB body cap, an empty-call throttle (50 calls in 10 minutes with over 80 per cent empty, not found or rejected) and a per-second cap per endpoint without a number (15). Retry-After is declared on too_many_auth_failures, rate_limited, too_many_unbilled, endpoint_busy and upstream_busy, the error table marks the retryable codes, the docs say a 503 endpoint_unavailable carries none and will not clear, and the Python client retries 429 and 503 honouring the header. Every operation is a read, including POST /v1/search, and a failed or timed-out call is refunded, so idempotency keys are not needed (15). No SLA. The terms summary says nothing about uptime and the pricing FAQ excludes outages, rate limits and platform changes from refunds; the 11 September 2026 archived home page advertised a 99.95 per cent enterprise SLA that the current pages have dropped (0). The endpoints are sold and labelled Live on the docs and coverage pages, but every one of the 143 carries x-qovia-status beta in the OpenAPI file, the API version is 0.1.0 and the MCP server reports 0.1.0 (5 of 10). 0+5+15+15+0+5 = 40.

Zyte API 85

Graded as a hosted API. status.zyte.com runs on Atlassian Statuspage with ten components and incident history (20). In the 90 days to 1 November 2026 its history feed lists two Zyte API incidents, both degraded browser rendering with higher latency and 520 errors, on 10 to 11 September and 13 September, neither marked as an outage, and three incidents outside the API, Scrapy Cloud periodic jobs on 17 August and the web dashboard and Scrapy Cloud periodic jobs down from 28 to 30 October, which Zyte says affected no other product. All partial, so minor (20 of 30). Rate limits are published as 3,000 requests a minute per key on standard plans and a custom limit on Enterprise, though per-site limits aren't (15). 429, 503 and 520 carry Retry-After, and the docs give a backoff table and say which responses to retry, per the 9 October check (15). Enterprise plans list service level agreements for support response times. No uptime SLA is published (5 of 10). Zyte API is generally available, and Zyte MCP carries no beta label on 1 November (10).

Qovia 30

Closed service. The Terms of Service is one paragraph that names no legal entity, address or liability terms, says Delaware law governs and that the page is a summary with the signed agreement governing; the repository's client is MIT. Between the closed and unclear bands (7 of 30). The privacy policy is one paragraph. Account information is used to deliver and bill, personal information is not sold, requests and results are not resold, deletion requests go to the support mailbox, and the agreement governs where it differs. No retention periods, no subprocessors, no DPA, and no statement about the cache the prov.source flag implies; the SECURITY.md repeats the same points (8 of 30). A 410 endpoint_disabled code exists for retired endpoints and the changelog is dated, but there is no deprecation policy or notice period and nothing is marked deprecated (5 of 20). Stripe is named on the pricing page as the card and Alipay processor; no other provider, data location or transfer basis is stated (3 of 20). 7+8+5+3 = 23.

Zyte API 67

A closed service with terms last updated on 22 September 2026 (unchanged on 1 November) that name Zyte Group Limited and contain a Zyte API section. The Python client is BSD 3-Clause (15 of 30). The privacy policy (30 August 2024), a DPA and a sub-processor list are public, with retention stated for support tickets (4 years) and invoices (7 years). Retention of request data and scraped content isn't stated, and the terms let Zyte use Service Data for product development and product training (17 of 30). Site tier changes get two weeks' notice and the Smart Proxy Manager retirement was announced with a date, but there is no standing API deprecation policy and the terms allow changes with or without notice (10 of 20). The sub-processor list names 36 companies with addresses and purposes, and the privacy policy names the United States and Ireland as processing locations (16 of 20).

Qovia 55

No x402, MPP or L402 on Qovia's own endpoints; USDT on TRC-20 is a top-up method from a console session, not a machine payment protocol. The vendor's five Actors on the Apify Store under the profile qovia (Qovia Data, the same Telegram handle and mailbox as the site), such as the Xingtu Actor at $0.01 to $0.06 a section, can be paid through Apify, whose prepaid token is sold over x402, so partial credit for a third-party route on part of the catalogue (10 of 40). Per-call prices are published without a login, per endpoint in the OpenAPI file, llms.txt and the docs, search at $5 and raw endpoints from $0.5 to $19.5 per 1,000, with the tier rule and payment fees stated (20). 50 trial calls for a new account, counted only when a call returns data; the quickstart says to top up when they run out and the docs ask for no card at sign-up, though no account was created to confirm it (20). A person signs up in a browser and creates a key; the MCP catalogue tools work without a key but data calls do not, and the Apify route reaches four platforms without a Qovia account (5 of 20). 10+20+20+5 = 55.

Zyte API 40

The official Python client documents x402 against api-x402.zyte.com, but our one unauthenticated request there on 1 November 2026, as on 9 October, returned 401 /auth/not-valid with WWW-Authenticate: Basic and no 402 challenge, and the main docs and pricing page don't mention it, so we score the line as not established (0 of 40). Per-1,000 prices for all five site tiers, screenshots and extraction are public, though a given site's tier needs the dashboard's cost estimator (20). $5 of credit for the first billing month on standard plans ($200 on Enterprise), with no card per the site, re-read in the pricing docs on 1 November (20). A person signs up in a browser, and the MCP route needs a browser sign-in too (0).

Qovia 77

API reading. Responses come in fixed page sizes per endpoint, from about 5 comments on Xiaohongshu to 100 Fliggy reviews, with limit only on Bilibili danmaku and no field selection; the record shape is compact and shared across posts, notes and videos. The MCP server loads four tools by default, keeps the catalogue out of context until search_endpoints and get_endpoint are called, and ?tools= selects platforms or everything, which on the MCP reading would score 25 (18 of 25). Cursor pagination with has_more on most lists, search_id on Douyin and Zhihu search, page numbers on Weibo, Xiaohongshu and Bilibili, sort options on several, and the cross-platform search filters by platform, content type, sentiment and whole-day date windows up to 90 days (17 of 20). One error object with 20 codes, request_id on every answer, the retryable set marked, refunded codes separated from never-charged ones, and MCP tool errors carrying error.code, the HTTP status and retry_after_seconds (19 of 20). All calls are reads, failed and empty calls are refunded, Retry-After is declared and the Python client retries; no readOnlyHint or other annotation appears in the vendor's 28 October tools/list snapshot (14 of 20). One required parameter on 117 of 144 operations and defaults set on the server, but the only official SDK is the Python client; Node and curl are examples (9 of 15). 18+17+19+14+9 = 77.

Zyte API 72

Graded on the REST API, with the MCP server noted. A request names the outputs it wants, so an agent can ask for extracted fields or pageContent in place of full HTML, but HTML and bodies come whole, up to 10 MB. Zyte MCP lists 34 tools at once, 26 of them for Scrapy Cloud, recounted from its docs on 1 November (15 of 25). No pagination applies to a single-URL call. Search takes maxResults from 10 to 100, and the Stats API pages and filters (14 of 20). Errors are problem+json with a stable type path, and the docs say which to retry and which to fix (20). Calls are reads, failed and rate-limited requests are free, and retries are safe. We could not read the MCP tool annotations, which need a sign-in (14 of 20). A call needs only url and one output flag. The only official client is Python, with a Scrapy plugin (9 of 15).

Qovia 60

API keys with scopes chosen at creation (every endpoint, search, every raw endpoint or one of 24 platform groups), an optional expiry, revocation in the console and hashed storage; the docs say the key is read from the Authorization or x-api-key header only, never the URL or a cookie, and 30 failed authentications from one IP in a minute are throttled. No OAuth and no rotation feature beyond creating another key (24 of 30). The whole surface is read-only retrieval, scopes restrict a key to platforms, the two MCP catalogue tools need no key, and the docs and SECURITY.md tell users to give AI tools a separate scoped key (17 of 20). Every response is third-party platform text, and the only related statement is that error messages never contain the data source's own text; nothing on treating returned content as untrusted (3 of 15). request_id is the usage record ID on every answer, the console lists every charge in a usage log, X-Qovia-Charged and X-Qovia-Balance headers report each call, and GET /v1/account returns the key's scopes and balance at no charge; no exportable audit log or per-call endpoint was found (11 of 15). No security.txt on qovia.ai or api.qovia.ai (404), no bug bounty, SOC 2 or ISO 27001; the repository's SECURITY.md names a Telegram handle and a mailbox for reports covering both hosts (5 of 20). 24+17+3+11+5 = 60.

Zyte API 55

API keys are revocable, an organisation can hold several, and none travels in a URL. Keys carry no permission scopes. Zyte MCP signs in over OAuth and works through its own key, mcp_access_key (22 of 30). An owner can set a blocking spending limit per key. We found no read-only mode, and the MCP docs warn that the agent can delete schedules and collections with no undo, leaving approval to the MCP client (8 of 20). The API returns untrusted web content, and the only guidance found is to review what the agent asks to do (2 of 15). The Stats API and dashboard break usage down by key, domain and request type, requests can be tagged, and each response has a request-id. No per-request log for the operator was found (10 of 15). ISO 27001 certification per the trust centre, a responsible disclosure programme with a hall of fame and no rewards, penetration test reports under NDA, and no security.txt (www.zyte.com/.well-known/security.txt answered 404 on 1 November) (13 of 20).