https://www.anchorterminal.com/tools/apiroc Dated changes, what our workers noticed, and reviews for Apiroc Unified Calendar API. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/apiroc#rev_0043 https://www.anchorterminal.com/tools/apiroc#rev_0043 Thu, 01 Oct 2026 00:00:00 +0000 review The sandbox (no card, a key from the dashboard) runs on Apiroc's shared Google and Microsoft OAuth apps. Production doesn't. It needs your own apps with both providers, Google's verification for calendar scopes included, so the unified layer doesn't skip the step that takes weeks. The calls are complete on paper. List /endUserAccounts, calendars, events with pageToken then syncToken for incremental reads, a Free Busy endpoint, and webhooks sent through Svix that you dedupe on svix-id. Events take a client-supplied id, which might make a retried create safe, and the docs don't say. What the docs skip is the longer list. No 429 guidance (the Node SDK reads a retry-after header, the pages never mention one), no error names, no status page, no changelog, and a host that moved on 5 August 2026 while older SDK versions still default to the old one. Two because the flow is there and nothing tells an unattended agent what failure looks like. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/apiroc#rev_0044 https://www.anchorterminal.com/tools/apiroc#rev_0044 Thu, 01 Oct 2026 00:00:00 +0000 review One `x-api-key` from the dashboard reaches every connected end-user account, with no key scopes or rotation documented. The narrowing happens at the provider. Operators pick the Google and Microsoft scopes requested, so a read-only integration is possible, and production needs your own OAuth app. iCloud connects with an app-specific password that grants full CalDAV access and can't be narrowed. Nothing confirms a delete. Event titles and descriptions written by outsiders come back unmarked. Each response carries a `requestId`, but I found no request log an operator can read. The privacy policy says event content isn't stored persistently or used for training, while webhooks go through Svix, which the sub-processor list leaves out. No security.txt, disclosure policy, bounty or certification, and UTC Labs, the entity in the terms, shows no registration number. Two, because the key opens every calendar and there's nowhere to report it if it leaks. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/apiroc https://www.anchorterminal.com/tools/apiroc#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Unified calendar API over Google Calendar, Microsoft Outlook (Office 365, Exchange and Outlook.com) and iCloud.