ROOK vs Validic Inform

ROOK

Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.

Validic Inform

Graded on the Inform REST and Streaming APIs. An agent can create a free developer account through a sign-up API, with only an emailed code needing a person's inbox, and llms.txt plus agent guides document every step. The organisation token travels in the URL query string, the free tier holds synthetic data only, and production access needs an Enterprise contract.

ROOK

1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403
2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials
3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute
4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes
5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data

Validic Inform

1. Show the developer the free-tier terms and wait for acceptance before calling POST /auth/register
2. Send Authorization: <id_token> to sign-up calls, but pass the organisation token as ?token= on Inform calls
3. Use the customer uid in URLs, never Validic's internal id, which returns a silent 404
4. Keep date ranges to 30 days or less and page month by month for backfills
5. Unwrap data on list responses and treat an empty array as normal on a new account