ShipBob vs TrackingMore

ShipBob 85

OpenAPI 3.0 spec for each version at marketplaceapi.shipbob.com, 89 operations in 2026-07. The openapi.json link in the docs index returns an HTML page, not the spec (25). llms.txt per version and a Markdown copy of each page (10). 88 of 89 operations have a description, and some say when to use them, such as the inventory level call for current stock questions. Few say when not to (14 of 20). All 199 parameters have a schema, with 46 enums and required fields marked. Sort order and shipping method are free strings, and many filters are comma-separated lists (10 of 15). 504 examples. 401 and 403 are documented on 64 operations, 400 on 58 and 422 on 18, 429 on none, and error bodies differ by domain, with RFC 7807 problem details in some and an errors array in others (11 of 15). Date-based versions, an upgrade guide per version and dated release notes (15).

TrackingMore 31

No OpenAPI or similar file was found in the docs, the SDK repositories or a search, and the reference at trackingmore.com/docs renders by script so its schemas were not read (0 of 25). No llms.txt or Markdown docs (0). The official SDK READMEs give one line per call, and the support centre explains when to pair create with get or a webhook and that the create response carries the result (8 of 20). Field names and the required tracking_number and courier_code appear in the SDK examples, with no types, enums or constraints readable (5 of 15). Examples in seven SDK languages and a table of HTTP and meta codes with messages (12 of 15). v4 in the path with v2 and v3 still served, and the support centre says there is no changelog for switching versions. No dated API changelog was found (6 of 15). 0 + 0 + 8 + 5 + 12 + 6 = 31.

ShipBob 55

OAuth 2.0 authorisation code grant with PKCE, read and write scopes per domain, one-hour access tokens, 30-day refresh tokens rotated on use, and a revocation endpoint. The MCP server adds dynamic client registration. Personal Access Tokens have every scope and no expiry, and can be revoked (27 of 30). An OAuth app can ask for read scopes only, MCP writes are limited to the channel created at consent, and inventory is read-only over MCP. A token has no read-only option, and no confirmation step for cancels was found (12 of 20). Orders, addresses, gift messages and return notes are written by third parties. The MCP security page covers token handling and consent, with nothing on injected text (3 of 15). No log of API calls for the operator was found. Shipment logs record warehouse events (2 of 15). The trust page says SOC 2 and ISO 27001 audits are complete and lists penetration testing. No security.txt, disclosure policy or bug bounty was found (11 of 20).

TrackingMore 31

One API key in the Tracking-Api-Key header, shown once, at most four per account, deleted in the web app. No scopes or expiry (20 of 30). No read-only key or least-privilege mode, and delete is one call (4 of 20). Tracking checkpoints are carrier text returned to the model, and no guidance was found (3 of 15). A webhook notification log exists in the web app; no log of API calls or key use was found (4 of 15). No security.txt (404), no security page on trackingmore.com, no certification, bug bounty or disclosure policy found. The CWILL privacy policy points to a trust site that was not read (0 of 20). 20 + 4 + 3 + 4 + 0 = 31.

ShipBob 41

API version 2026-07 was released on 31 July 2026, 69 days before the check (20 of 30). The release notes have two entries under July 2026, the 2026-07 version and PKCE, and the second has no day, so it can't be placed inside the 90 days. The tutorials repository had four commits from 17 to 20 August. We gave half for this line (10 of 20). Closed service with dated release notes and a support address that promises a first reply within one business day (9 of 15). The MCP server isn't in the official registry, and no official SDK was found (0 of 15). OpenAPI specs are kept for each version. Nothing else to judge package health on (2 of 10).

TrackingMore 19

Read as a closed service. No dated API change was found. The SDKs were last pushed between February and December 2024, the support articles are dated 2023 and 2024, and the reference is undated (0 of 30). No releases or dated entries in the last 90 days were found (0). Support by email and chat with a help centre; GitHub issues were not read (6 of 15). Seven official SDKs exist but none has changed since December 2024 (10 of 15). The Node SDK has tests and no CI workflow (3 of 10). 0 + 0 + 6 + 10 + 3 = 19.

ShipBob 78

Closed service. The Terms of Service, updated 22 May 2026, name ShipBob, Inc. and Illinois law. The tutorials repository has no licence file (15 of 30). A privacy policy dated 29 March 2024, which says it doesn't apply where a commercial contract governs, and a DPA dated April 2026 under which ShipBob deletes or returns personal data at the end of the service if the merchant asks. No retention period is stated in days, and the terms grant ShipBob a perpetual right to use merchant content for product improvement (17 of 30). A written version policy with 24 months of support for each version, end dates in a table, and the phased shutdown of 1.0 published with dates (20 of 20). A public list of about 30 subprocessors with purpose and location, all in the United States, with no date on the page (17 of 20).

TrackingMore 57

Closed service. The terms are the CWILL group's (effective 9 January 2026), which say the contracting entity depends on the product, and the privacy policy names CHANNELWILL CO., LIMITED for TrackingMore. The SDKs are MIT (15 of 30). The privacy policy (8 August 2026) distinguishes controller and processor roles and links a DPA and a sub-processor list, neither read; no retention periods were read (12 of 30). v2 and v3 are still served with no notice policy or dates (4 of 20). A sub-processor list exists at trust.cwill.com and was not read; no data location is stated on the pages read (8 of 20). 15 + 12 + 4 + 8 = 39.

ShipBob 77

Read with the hosted lines and scored on the REST API at api.shipbob.com. Statuspage at status.shipbob.com with three components and 90-day uptime bars (20). The history shows no incident from August to October 2026 and the incident feed is empty. The page says it reports major outages of the website or dashboard, has no API component and has posted no incident since it was created in July 2024, so the clean record says little about the API. We scored it as minor only instead of clean, a departure from the checklist (20 of 30). 150 requests a minute, sliding window, per user and application (15). A 429 carries x-retry-after, the errors page recommends exponential backoff, and a duplicate reference_id returns 422, which makes a retried create safe. No idempotency key (12 of 15). The terms publish fulfilment turnaround SLAs with 14 exclusions. No uptime SLA for the API was found (0). The dated API versions are generally available (10).

TrackingMore 65

Read with the hosted lines and scored on the REST API v4 at api.trackingmore.com. status.trackingmore.com is a hosted status page with uptime and a status update history (20). Its figures and history render by script, so the 90 days could not be read; the static text says there were no updates in the last 7 days (5). Rate limits are published per endpoint, 3 requests a second on trackings/create and 10 a second elsewhere, per account (15). The support centre says a 429 means the application should stop and wait 120 seconds, and a repeated create answers meta code 4101 rather than creating a duplicate. No Retry-After and no idempotency key (10 of 15). No SLA document was found. The Enterprise plan lists 99.99 per cent API uptime as a feature and the API page claims 99.9 per cent uptime, which is marketing rather than a published SLA (5 of 10). v4 is the current version and not marked beta (10). 20 + 5 + 15 + 10 + 5 + 10 = 65.