RocketReach API vs ZeroBounce

RocketReach API 11

No changelog or release notes were found (9 October; rocketreach.co hosts not re-read on 4 November 2026 because the terms bar automated data collection). The 9 October note set recency at 20 on docs page update dates (8 October and 11 September 2026). Page dates that record no API change don't set recency, and a closed service's recency is its last dated API change (wrike, buttercms, everee read it so). No dated API change is on record. The Python SDK, the vendor's other dated source, read by clone on 4 November 2026, has its last code change on 26 March 2025 (a bug fix to an exception call), version 2.1.8 with no tags, and only repository housekeeping since (21 August and 5 October 2026). Over 180 days (0, 20 before). No dated changelog entries or releases in the 90 days from 6 August (0 of 20). Support by email and a status page that posts updates, per 9 October (5 of 15). The SDK isn't current, and the official MCP registry wasn't searched, since this run doesn't use its JSON API. The partial is kept pending the founder's rule on in-between values (3 of 15). The SDK repository has a Renovate configuration and states Python 3.4 or later (3 of 10). 0 + 0 + 5 + 3 + 3 = 11.

ZeroBounce 70

Closed service. The JavaScript SDK 3.0.0 was published on 25 October 2026 (30). No API changelog; the dated changes found in 90 days are that release and status-page notices, fewer than three releases (10 of 20). Support by email and 24/7 chat per the docs, a public status page; replies not tested (10 of 15). Official SDKs in many languages and an MCP server (15). Package health not checked (5 of 10). 30+10+10+15+5 = 70.

RocketReach API 30

RocketReach's terms bar automated data collection on its website and services, so rocketreach.co and its subdomains were not re-read on 4 November 2026. Per the 9 October check. REST takes one key per account in the Api-Key header. Only one key is active at a time and generating a new one invalidates the old. The MCP server uses OAuth 2.1 with PKCE, open dynamic client registration, one-hour access tokens, 30-day refresh tokens that rotate, and a revocation endpoint. The access token carries the API key inside an encrypted envelope, and the account tool returns api_key in its response, so the key reaches the model's context (18). The docs say older clients may still send the key as an api_key query parameter, marked deprecated. This run settled that a query-string credential takes the checklist's fixed 10 off, where the 9 October note took 5 (8 of 30, 13 before). One scope, rocketreach:read, covers every tool, including lookups that spend credits and add contacts to My Contacts. No read-only mode, per-key limit or confirmation step was found. The account object has an api_key_domain field (4 of 20). Results are third-party profile data. No prompt-injection guidance was found (3 of 15). Usage and rate-limit counts from the account endpoint, a recent-errors panel in account settings, RR-Request-ID on webhooks, and MCP lookups tagged with the client name. No per-call log was found (8 of 15). security.txt is valid, with a contact address and an expiry of 8 June 2029, a reporting route with no stated acknowledgement time, which this run settled at 7. The DPA lists security measures in an annex and names a Trust Centre that we did not find linked. No certification or bug bounty was found. No advisory for the rocketreach PyPI package on osv.dev on 4 November 2026 (7 of 20, 6 before). 8 + 4 + 3 + 8 + 7 = 30.

ZeroBounce 65

Several named keys besides a Master key, regeneration, deactivation and IP whitelists (25), less 10 because the documented calls carry the key in the api_key query string (15 of 30). Validation only reads, though file and list endpoints can delete uploads (12 of 20). Results are structured status codes with little free text (10 of 15). API usage and dashboard statistics endpoints (10 of 15). SOC 2 Type 2, ISO/IEC 27001:2022, continuous testing with Intigriti and penetration testing with BitSentinel; no public disclosure policy found (18 of 20). 15+12+10+10+18 = 65.

RocketReach API 10

Per the 9 October check, not re-read on 4 November 2026, because RocketReach's terms bar automated data collection on its website and services. No x402, MPP or L402 in the docs or terms (0). The docs publish credit costs per action for Universal Credits, such as 2 credits for a professional email and 6 for a phone. The pricing page is drawn by script and showed our reader only its title, so no price in dollars was read, and the docs tell users without a paid plan to email for an API plan (5 of 20). The site's description says to try for free, and the rate-limit page implies an unpaid account can call the API until throttled. What a free account gets through the API was not established (5 of 20). A person signs up in a browser, the terms say account holders warrant they are human, and MCP authorisation needs a browser login (0). Total 10. The pricing lines are scored on what could be read.

ZeroBounce 35

No x402, MPP or L402 (0). Per-credit prices public, from $39 for 2,000 validations (20). Freemium of 100 validations a month for business or premium domains; a card requirement isn't stated, and free webmail addresses don't qualify (15 of 20). A person signs up in a browser (0). 0+20+15+0 = 35.

RocketReach API 72

Per the 9 October check, not re-read on 4 November 2026, because RocketReach's terms bar automated data collection on its website and services. Each reference page's Markdown twin carries an OpenAPI 3.1 definition for its operation, 17 operations in all. No single downloadable file was found (22 of 25). llms.txt and Markdown twins on the docs host (10). The MCP tools page states what each tool returns, what it costs and which tool to call next. REST operation descriptions are thin, and Company Lookup carries the Company Search subtitle (14 of 20). Query parameters are typed, with enums on lookup_type and order_by. No lookup parameter is marked required although one identifier is needed, and metadata is a free object (10 of 15). Error table, a worked 402 body, an MCP error catalogue and response examples. Every operation lists the same generic error set (11 of 15). The version sits in the path (/api/v2), with the Universal Credits endpoints alongside. No changelog was found (5 of 15). Total 72.

ZeroBounce 54

No OpenAPI or other machine-readable contract found; a Postman collection is linked (5 of 25). llms.txt lists marketing pages, and the docs have no Markdown twins (5 of 10). Endpoint pages explain timing, credits and when to use batch or file APIs (14 of 20). Parameter tables and listed status and sub-status values, including the ai_agent_mailbox sub-status added in July 2026 (10 of 15). Examples per endpoint, a sandbox and an error-code page (12 of 15). v2 paths, an API migration page and dated maintenance notices on the status page, with no API changelog (8 of 15). 5+5+14+10+12+8 = 54.

RocketReach API 64

RocketReach's terms bar automated data collection on its website and services, so rocketreach.co and its subdomains were not re-read on 4 November 2026. Per the 9 October check. Hosted lines. Status page on incident.io at status.rocketreach.co with five components, among them API and MCP (20). In the last 90 days it lists eight entries. On 20 August 2026 degraded performance ran from 12:00 AM to 10:00 AM across the site, extension, API and MCP, with a second hour that afternoon, delayed webhooks and a 29-minute outage in the evening. On 27 August elevated errors lasted 61 minutes. A 71-minute maintenance window on 27 September, in which the notice said API and MCP calls would be unresponsive or throttled, was announced on 15 September. Read as one major day and a second incident of about an hour. Both remain inside the 90 days from 6 August, and the status page after 9 October couldn't be read, so the recorded award is kept, a partial pending the founder's rule on in-between values (7 of 30). Rate limits published per plan and endpoint, plus a global 10 requests a second (15). 429 carries Retry-After and the docs show a retry example. No idempotency keys, though repeat lookups are free (12 of 15). No SLA found in the terms, the subscription agreement or the docs (0). The API and MCP server are not marked beta (10). Total 64.

ZeroBounce 75

Hosted lines. Statuspage at status.zerobounce.net with API, API-US, API-EU, Bulk API, website and Cloudflare components (20). The incident feed for 8 August to 6 November shows a 6-minute members platform disruption on 9 September, about 3 minutes of reduced EU API availability on 1 October, and a file upload issue on 26 October resolved within 6 minutes, all minor (20). Limits published per endpoint group with numbers and block lengths (15). 429 is documented with advice to throttle, but no Retry-After, and a block can last an hour or a day (10 of 15). No SLA found (0). Generally available (10). 20+20+15+10+0+10 = 75.