airSlate SignNow vs Youtrust

airSlate SignNow 81

Graded on the REST API, with the MCP server noted. OpenAPI 3.0.3 and Swagger 2.0 are public, with 226 paths and 354 operations (25). docs.signnow.com/llms.txt indexes a Markdown copy of every page, with llms-full.txt (10). All 354 operations have a description and the MCP tool descriptions say what to call next, but the API reference rarely says when not to use an endpoint (14). The spec marks required fields often but holds only 29 enums across 354 operations (9). 342 operations have examples and there is an API errors page, though numeric codes aren't unique (12). The changelog is dated by month back to February 2025. The spec version stays at 1.0.0 and paths mix unversioned and /v2 routes (11).

Youtrust 90

A public OpenAPI 3.0.0 file with 178 operations on 114 paths, a bearer scheme and 282 enums (25). developers.youtrust.com serves llms.txt, a per-section llms.txt and a Markdown twin of every page (10). Every operation has a description, 28 of them under 40 characters, and the guides explain the signature request lifecycle, when to use templates and the Tolerant Reader rule (14 of 20). Required fields, 282 enums, a Safe String type with stated rules, and a free-form metadata object (13 of 15). 1,307 examples in the file, every operation documents 400, 401, 403, 404, 405, 429 and 500, the error page gives the type, detail and invalid_params shape with retry guidance per code, and a list of error types is published (15). v3 in the path, a versioning page with compatibility rules, a Deprecated tag in the file, and a changelog with ten entries dated 13 to 21 October 2026 and an RSS feed, with no removal timeline (13 of 15). 25 + 10 + 14 + 13 + 15 + 13 = 90.

airSlate SignNow 93

Graded as a hosted API. Statuspage at status.signnow.com with six components including API (20). The history feed shows one incident in the 90 days to 1 November, a minor one on 3 September 2026 that made the SignNow University site unavailable for eight minutes, and none on the API component. The 17 October maintenance window of up to 15 minutes was announced on 2 October (30). Limits are published with numbers, 500 requests an hour in Development and 1,000 in Live (15). 429 is documented with X-RateLimit-Limit, Remaining and Reset headers and advice to back off exponentially. No Retry-After header and no idempotency key were found, and sending an invite is a charged write (8). The SLA commits to commercially reasonable efforts for 99.9 per cent monthly uptime with credits of 10 or 30 per cent (10). The REST API is generally available (10).

Youtrust 85

Read with the hosted lines and scored on the Public API v3 at api.yousign.app, the surface both MCP servers call. yousign.statuspage.io on Atlassian Statuspage has an incident history and a feed (20). Between 5 August and 3 November 2026 the feed records HTTP 500 errors on the public API from 11:24 to 11:35 and 14:42 to 15:19 CEST on 7 October, caused by an infrastructure provider; about 45 minutes of delayed advanced and unavailable qualified signatures on 13 August; identity verification delays at a third-party provider on 1 September (most of a day), 2 September, 14 September and 16 October (33 minutes); 16 minutes of delayed seals on 16 October; email delays to Microsoft mailboxes on 4 September; and Orange network routing on 2 October. Several incidents, mostly at identity providers, and no outage of the core API over an hour (20). Rate limits are published per minute and hour for each environment (15). 429 answers Too many requests with x-ratelimit headers and a Ratelimit-Reset in seconds, the docs say to slow down and increase the delay, and there are no idempotency keys and no Retry-After (10 of 15). The API pricing page states 99 per cent and 99.9 per cent SLAs on the Plus and Pro plans (10). v3 is generally available (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

airSlate SignNow 62

OAuth 2.0 with password, refresh and authorisation code grants and a scope parameter that limits a token to URL patterns. API keys can be deleted but don't expire and work for all API requests, and the hosted MCP server adds OAuth with PKCE (24). We deducted 5 of the possible 10 for secrets in URLs, because embedded links returned by the API carry an access_token query parameter, with a 15 to 45 minute expiry on embedded sending links (19). A URL-pattern scope allows a read-only token, the hosted MCP grant covers documents and templates only, and the bundled skill tells agents to wait for confirmation before sending. Nothing enforces that confirmation (12). The API returns document text and field values written by signers, and no prompt-injection guidance was found (3). The API dashboard logs every request and webhook delivery, and documents carry a full history endpoint (13). SOC 2 Type II, PCI DSS and HIPAA per the security page and a HackerOne bug bounty by invitation. security.txt still returns 404 on 1 November, and the MCP repository's SECURITY.md still has a placeholder contact (15).

Youtrust 68

Bearer API keys with an Organization or Workspace scope and a Read-Only or Full-Access permission, separate per environment, created only by Admins and Owners, and OAuth for the AI connector with revocation in account settings. No expiry or rotation guidance found (26 of 30). Read-Only keys, workspace scoping, draft-then-activate, and the AI connector's examples ask before sending. The Developer MCP's execute-request runs any call with the key's full permissions, activation, cancellation and deletion included, and the API has no approval step (14 of 20). Signer names, field answers and documents return through the API, Safe String rules strip HTML, URLs and email addresses from inputs, and no injection guidance was found (4 of 15). Audit trails per signature request and signer, downloadable, plus consumption records; no log of API calls or key use was found (8 of 15). PGP-signed security.txt, a bug bounty and annual technical audits on the security page, eIDAS certification as a trust service provider, hosting in France. ISO 27001 was not named on the pages read (16 of 20). 26 + 14 + 4 + 8 + 16 = 68.

airSlate SignNow 35

No x402, MPP or L402 found (0). The developers page states per-invite prices, from $2 at 500 invites to $1.20 at 5,000. The full plan table is a JavaScript page we couldn't read, so we scored between plan-only and per-unit (15). Development mode is free with up to 500 invites, and the help centre says the free trial needs no credit card (20). A person has to register in a browser and verify an email address before the first key exists (0).

Youtrust 40

Read with the hosted rubric. No x402, MPP or L402 (0). API plan prices are public without login, Plus from €104 a month and Pro from €129 with €2 per extra signature (20). The sandbox trial lasts 40 days and needs no credit card per the API pricing page (20). A person signs up in a browser and an Admin creates the key there (0). 0 + 20 + 20 + 0 = 40.