Ravelry vs Rebrickable

Ravelry 0

Graded on what is public. With the documentation behind the login, the context cost, pagination, error, retry and SDK lines cannot be read (0). The apps directory shows apps working with and without a Ravelry account, which suggests a public read mode, but the parameters are not public.

Rebrickable 60

Responses can be sized with page_size, inc_part_details and inc_color_details, though there is no field selection (18 of 25). Pagination by page and page_size up to 1,000, ordering with a minus prefix, and filters such as part_nums, search and theme_id (18 of 20). Only the 429 case is documented, with no error body shape or codes (6 of 20). Reads are safe to retry; the POST, PUT, PATCH and DELETE operations on a user's sets and lists have no idempotency key (10 of 20). One header and few required parameters, but no official SDK in any language (8 of 15). Total 60.

Ravelry 0

Graded on what an outside agent can read. The API documentation at ravelry.com/api, the API help page and the API group all redirect to the login page, so no contract, llms.txt, endpoint description, typed input, example, error response or changelog was read (0 on every line). This says nothing about the documentation behind the login, which the operator can read with an account.

Rebrickable 54

Public Swagger 2.0 spec at /api/v3/swagger/?format=openapi with 43 paths and 62 operations, but empty title and version, no security definitions and no response schemas beyond the codes (20 of 25). No llms.txt or Markdown docs (0). Every operation has a summary and description, several cut off mid-sentence, and none says when not to use it (10 of 20). Typed path, query and form parameters, no enums, and theme_id and part_cat_id typed as string on one path and number on another (8 of 15). No request examples in the spec, and only 200, 201 and 204 documented, no 4xx or 5xx; the docs page documents 429 (4 of 15). v3 in the path and a dated changelog back to 2017, with no stated versioning policy (12 of 15). Total 54.

Ravelry 52

Closed service with clear terms naming Ravelry, LLC under Massachusetts law, last updated 1 February 2017 (15 of 30). The privacy policy of 23 February 2026 names each provider with the data it gets (AWS, SendGrid, Mailgun, New Relic, BugSnag, Google Maps, reCAPTCHA) and lets a person delete the account, but states no retention periods and no DPA (15 of 30). No deprecation policy or dated notices found (0 of 20). Third parties are named with data types, and AWS is named as the store, with no region (10 of 20). Total 40.

Rebrickable 29

Closed service whose terms answered a Cloudflare bot check on 3 November 2026, so their clarity is unchecked (5 of 30). The privacy policy answered the same check, so no data handling statement was read (0 of 30, unchecked). The changelog records removals with dates, MOC support on 19 April 2020 and print_of on 23 July 2025, with no written notice period (8 of 20). Subprocessors and data locations were not read (0 of 20, unchecked). Total 13.

Ravelry 0

The credential model is behind the login, so the credential, least-privilege and audit lines score nothing (0 of 30, 0 of 20, 0 of 15). Pattern notes, project notes and forum text are user content, and no prompt-injection guidance was found (0 of 15). /.well-known/security.txt redirects to the login page, and no disclosure policy, bug bounty or certification was found (0 of 20). Total 0.

Rebrickable 10

One key per account with no scopes, no documented expiry or revocation, and it may be sent as a query parameter, so 10 less 10 (0 of 30). A user token minted from the account's username and password reaches every write on that person's lists, with no read-only mode (0 of 20). The catalogue is curated data, though MOC names and user list names are user content, with no guidance (10 of 15). No audit log or per-call visibility found (0 of 15). security.txt answered the bot check and no disclosure policy, bug bounty or certification was found (0 of 20). Total 10.

Ravelry 20

Read with the hosted rule. No x402, MPP or L402 on any public page (0). Ravelry calls itself a free website, but no page outside the login states whether a developer key costs anything, so the pricing line is part met (10 of 20). An account is free, and no card is asked for on the invitation page; whether the developer key needs a Pro account couldn't be read (10 of 20). A person must register in a browser and read the docs there (0). Total 20.

Rebrickable 30

Read with the hosted rule. No x402, MPP or L402 (0). The API page says a key comes with a registered account and no API price is stated; the Pro Plan's price is behind the bot check, so no full price list is public (10 of 20). A free account gives a key with no card (20). A person must register and generate the key in the profile settings in a browser (0). Total 30.

Ravelry 45

Read with the hosted lines. Statuspage at ravelry.statuspage.io with one uptime metric for www.ravelry.com and no components, so the line is part met (15 of 20). The incident history page is empty and the status page shows no incident from 20 October to 3 November 2026. A page that has logged nothing says little, so a clean window counts 20 of 30, as it did for Resy. Rate limits, 429 handling and retry guidance sit in the API documentation behind the login, so none is public (0, 0). No SLA found (0). The API is not labelled beta and 36 listed apps run on it (10). Total 45.

Rebrickable 38

Read with the hosted lines. No status page found on the API page or docs (0). No readable incident history (5). Rate limit stated in numbers, one request a second on average with a small burst allowance (15). 429 responses are documented, with a warning that ignoring them brings a temporary IP ban of one to two days or a permanent one, but no Retry-After, backoff guidance or idempotency keys for the writes on user lists (8 of 15). No SLA (0). The API is v3 and not marked beta, though the docs say it is severely overloaded and new apps might be prevented (10). Total 38.