YouCanBookMe API vs Zoom Scheduler API

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Zoom Scheduler API 61

The reference states OpenAPI version 3.1.1, but no specification file is linked from the page, the API catalogue or llms.txt. A Markdown copy of the whole reference is published (10). llms.txt, Markdown copies of pages and an API catalogue at /.well-known/api-catalog.json (10). Most operations carry one line such as "Patches a scheduled event". The available times and booking operations say when to use them (8). Request bodies are typed, with 55 required marks, 38 enumerated fields and email, date and date-time formats. The Markdown copy and the static page omit query and path parameters (9). Every request body has an example and each operation lists its error statuses with a code name, some misspelt (11). The path is versioned v2 and the changelog has dated Scheduler entries (13). Total 61.

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Zoom Scheduler API 63

Graded as a hosted API. Statuspage site at status.zoom.us (redirects to www.zoomstatus.com) with Zoom Scheduler as its own component and REST API and Webhooks under Zoom Developer Platform (20). The front page shows 25 September to 9 October 2026, with no incident naming Scheduler or the REST API. The developer documentation site was degraded for 1 hour 54 minutes on 3 October. The history page is drawn by script and the status API is closed by robots.txt, so 90 days could not be read (10). Every Scheduler operation is labelled Light, which is 4 a second and 6,000 a day on Free, 30 a second on Pro and 80 a second on Business and above, per account (15). The docs say to wait and retry on 429 and that the daily-limit response carries a header saying when to resume. No Retry-After is named and no idempotency key exists for booking writes (8). No SLA found, and the API terms say Zoom does not guarantee uptime (0). No beta label on the Scheduler API, and Zoom's lifecycle page treats an initial release as stable (10). Total 63.

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Zoom Scheduler API 43

No field selection was found, and a schedule object runs to several hundred lines of fields. Query parameters could not be read (8). List responses return next_page_token, and the changelog records filters by team, account scope and created or updated time. The parameter list itself was not readable (14). Errors carry a status and a short code name such as InvalidArgument, NotFound or Conflict, with a 409 on booking conflicts and little detail (12). No idempotency key or safe-retry guidance for POST /scheduler/attendee (3). Booking needs six fields. No official SDK covers Scheduler, and Zoom Rivet 0.3.0 has no Scheduler module (6). Total 43.

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Zoom Scheduler API 54

OAuth 2.0 with granular scopes per operation, user and admin variants, PKCE, one-hour access tokens and revocation (30). The OAuth docs show refresh tokens and device codes sent in the URL query string as an option, which takes 10 off (20). Read scopes are separate from write, update and delete scopes, and Server-to-Server scopes need an administrator's approval. No confirmation step for cancelling or deleting (14). Booker names, answers and meeting notes written by outsiders reach the model, with no injection guidance found (0). No audit log of API calls was found in the pages read (0). security.txt valid to 31 December 2029, a disclosure policy with safe harbour, a private HackerOne bounty, security bulletins, and a SOC 2 Type 2 report for October 2024 to October 2025 that names Zoom Scheduler and Zoom APIs (20). Total 54.

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.

Zoom Scheduler API 70

Closed service under the Zoom API Licence and Terms of Use of 16 July 2025 (15). The Privacy Statement of 17 September 2026 gives no fixed retention periods. The Terms of Service delete customer content 30 days after termination, and both documents say communications-like customer content is not used to train AI models. The DPA is a PDF we did not read (18). A lifecycle page describes deprecation and sunset stages and the changelog tags them, but the API terms let Zoom change or deprecate APIs without prior notice, with only commercially reasonable efforts to tell developers (8). The sub-processor list, updated 2 October 2026, names 24 third parties and 23 affiliates with locations and has an email sign-up for changes (18). Total 59.

YouCanBookMe API 30

No x402, MPP or L402 (0). Seat prices public in the help centre's pricing article (Individual $9, Professional $13, Teams $18 a month, less yearly and over two years); the pricing page's own figures did not render for us, and nothing is priced per call (10). A Free plan and a 14-day trial of every feature with no card (20). A person signs up in a browser and the Account Owner generates the key by hand (0). 0 + 10 + 20 + 0 = 30.

Zoom Scheduler API 25

No x402, MPP or L402 (0). Seat prices are public, $5.99 a user a month or $4.99 billed yearly, with nothing per call (10). Scheduler Basic is free with no card and a 14-day trial is advertised, but the pricing page lists API access under the paid plan and whether the free plan or the trial can call the API was not established (15). A person signs up and creates a Marketplace app in a browser (0). Total 25.