{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/didit.json", "name": "Didit", "score": 75, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business", "kyc.cases" ], "slug": "didit" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/persona.json", "name": "Persona", "score": 69.5, "shared": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening", "kyc.cases" ], "slug": "persona" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/sumsub.json", "name": "Sumsub", "score": 68.5, "shared": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening", "kyc.cases" ], "slug": "sumsub" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/socure-riskos.json", "name": "Socure RiskOS", "score": 63.5, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business", "kyc.cases" ], "slug": "socure-riskos" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/complycube.json", "name": "ComplyCube", "score": 63.7, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business" ], "slug": "complycube" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/middesk.json", "name": "Middesk", "score": 59, "shared": [ "kyc.business", "kyc.screening", "kyc.cases", "kyc.identity" ], "slug": "middesk" } ], "tool": { "slug": "alloy", "name": "Alloy", "vendor": "First Mile Group, Inc. (Alloy)", "vendorUrl": "https://www.alloy.com", "kind": "http-api", "category": "identity-verification", "summary": "Alloy is an identity and fraud decisioning platform for banks and fintechs. Its API runs onboarding journeys and evaluations that orchestrate identity, business, document and watchlist checks across third-party data vendors, with case management and ongoing monitoring.", "url": "https://www.anchorterminal.com/tools/alloy", "markdownUrl": "https://www.anchorterminal.com/tools/alloy.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/alloy.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/alloy.json", "license": "Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@alloyidentity/web-sdk" } ], "auth": "mixed", "authNotes": "Account-level token and secret (older accounts use a workflow token and secret), sent as HTTP basic auth or exchanged at /v1/oauth/bearer for a one-hour Bearer token with client credentials. Up to five active secrets per key, rotated and revoked in the dashboard by users with key permissions. No scopes. The same keys serve sandbox and production, chosen by base URL or the `alloy-sandbox: true` header. Keys come with a customer contract (checked 2026-10-14).", "pricing": "paid", "pricingNotes": "No public prices. www.alloy.com/pricing returns 404 and the site routes buyers to a demo. Production calls invoke third-party data vendors and can incur charges, while sandbox calls don't (https://developer.alloy.com/public/docs/sandbox-vs-production, checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs index, the API reference or the website (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 20569, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.alloy.com/public/docs/introduction", "mcpTools": { "url": "https://api.alloy.cx/mcp", "checkedAt": "2026-10-02T22:09:59.902886223Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-02T22:09:59.902886223Z" }, "llmsTxt": "https://developer.alloy.com/public/llms.txt", "capabilities": [ "kyc.identity", "kyc.business", "kyc.screening", "kyc.documents", "kyc.cases" ], "tags": [ "hosted", "enterprise", "sales-led", "api-key", "oauth", "llms-txt", "webhooks", "sandbox", "status-page", "soc2" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 52.4, "grade": "D", "agentReady": false, "rank": 782, "ranked": true, "rankOf": 1076, "categoryRank": 16, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 62 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 59, "points": 11.8, "reason": "Read with the hosted lines. status.alloy.com is a Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations components (20). Nine incidents between 17 July and 9 October 2026, four labelled major. Elevated error rates on the Journeys API on 21 July, resolved within about an hour, hit the Production API. The others marked major were a Socure document verification failure through the SDK on 10 September (about 4.5 hours), a Loqate address formatter outage on 20 August and a 9-minute dashboard login problem on 17 July. We scored 10 because only one major touched the API itself (10). Limits are set per endpoint and account with no published numbers, and responses carry `alloy-ratelimit-limit`, `-remaining` and `-reset` headers (7 of 15). A 429 carries `retry-after`, and the retry guide names retryable codes and asks for exponential backoff with jitter. No idempotency key for writes was found (12 of 15). No SLA found (0). The API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). llms.txt with 247 entries and a Markdown copy of each page (10). Descriptions explain each endpoint and flag deprecated ones, but the evaluations endpoint says inputs vary with each workflow's configuration (13 of 20). Typed schemas where the payload is fixed, and dynamic bodies for evaluations and journeys (9 of 15). curl examples, and an error table with an HTTP code and a minor code for each case (13 of 15). A v1 path and dated Web SDK changelog entries, with product updates on the marketing site. No API changelog was found (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 52, "points": 8.45, "reason": "No field selection, and evaluation and journey responses return the full decision payload (10 of 25). Paginated lists for batches, cases and investigations, with filters on cases (14 of 20). Errors carry `status_code`, `minor_code`, `type`, `message`, `details` and an `error_token`, with a documented table (18 of 20). No idempotency key. Journey application reruns are explicit endpoints, and the webhook guide asks receivers to handle duplicates (6 of 20). No server-side SDK. The npm and Android packages are capture SDKs for the end-user document step (4 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 49, "points": 8.57, "reason": "An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. Up to five active secrets per key, with rotation and revocation in the dashboard. No scopes were found, and the bearer token has the same access as the key (20 of 30). An IP allowlist exists (error 4016) and dashboard roles govern who manages keys. No read-only key (7 of 20). Responses carry data returned by third-party vendors and AI analysis summaries, with no injection guidance (3 of 15). Webhook logs and dashboard records, with no API audit log found (7 of 15). The security page says Alloy is SOC 2 Type 2 certified, runs yearly penetration tests and takes vulnerability reports by email. security.txt returns 404 and no bug bounty was found (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. www.alloy.com/pricing returns 404 and the site asks visitors to schedule a demo (0). No trial or free tier found. Sandbox mode exists for customers (0). Access is through sales (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). Web SDK 2.12.0, 2.13.0 and 2.14.0 in September plus 2.16.0 in October (20). A closed service with a help centre, a product updates page and an AI support chat added in September. GitHub issue handling not applicable (10 of 15). The only official packages are capture SDKs, current (7 of 15). @alloyidentity/web-sdk is MIT and current. CI wasn't checked (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 62, "points": 5.43, "note": "editorial 38, provenance 86", "reason": "Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI systems (15 of 30). The privacy policy, dated 29 August 2025, names First Mile Group, Inc. d/b/a Alloy and gives retention criteria without periods. No public DPA was found (10 of 30). Endpoints are marked deprecated in favour of the Events API and Investigations, with no dates (8 of 20). The security page says the data centre is in the United States. No sub-processor list was found (5 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "No field selection, and evaluation and journey responses return the full decision payload (10 of 25). Paginated lists for batches, cases and investigations, with filters on cases (14 of 20). Errors carry `status_code`, `minor_code`, `type`, `message`, `details` and an `error_token`, with a documented table (18 of 20). No idempotency key. Journey application reruns are explicit endpoints, and the webhook guide asks receivers to handle duplicates (6 of 20). No server-side SDK. The npm and Android packages are capture SDKs for the end-user document step (4 of 15).", "maintenance": "Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). Web SDK 2.12.0, 2.13.0 and 2.14.0 in September plus 2.16.0 in October (20). A closed service with a help centre, a product updates page and an AI support chat added in September. GitHub issue handling not applicable (10 of 15). The only official packages are capture SDKs, current (7 of 15). @alloyidentity/web-sdk is MIT and current. CI wasn't checked (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. www.alloy.com/pricing returns 404 and the site asks visitors to schedule a demo (0). No trial or free tier found. Sandbox mode exists for customers (0). Access is through sales (0).", "reliability": "Read with the hosted lines. status.alloy.com is a Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations components (20). Nine incidents between 17 July and 9 October 2026, four labelled major. Elevated error rates on the Journeys API on 21 July, resolved within about an hour, hit the Production API. The others marked major were a Socure document verification failure through the SDK on 10 September (about 4.5 hours), a Loqate address formatter outage on 20 August and a 9-minute dashboard login problem on 17 July. We scored 10 because only one major touched the API itself (10). Limits are set per endpoint and account with no published numbers, and responses carry `alloy-ratelimit-limit`, `-remaining` and `-reset` headers (7 of 15). A 429 carries `retry-after`, and the retry guide names retryable codes and asks for exponential backoff with jitter. No idempotency key for writes was found (12 of 15). No SLA found (0). The API is generally available (10).", "schema": "Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). llms.txt with 247 entries and a Markdown copy of each page (10). Descriptions explain each endpoint and flag deprecated ones, but the evaluations endpoint says inputs vary with each workflow's configuration (13 of 20). Typed schemas where the payload is fixed, and dynamic bodies for evaluations and journeys (9 of 15). curl examples, and an error table with an HTTP code and a minor code for each case (13 of 15). A v1 path and dated Web SDK changelog entries, with product updates on the marketing site. No API changelog was found (8 of 15).", "security": "An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. Up to five active secrets per key, with rotation and revocation in the dashboard. No scopes were found, and the bearer token has the same access as the key (20 of 30). An IP allowlist exists (error 4016) and dashboard roles govern who manages keys. No read-only key (7 of 20). Responses carry data returned by third-party vendors and AI analysis summaries, with no injection guidance (3 of 15). Webhook logs and dashboard records, with no API audit log found (7 of 15). The security page says Alloy is SOC 2 Type 2 certified, runs yearly penetration tests and takes vulnerability reports by email. security.txt returns 404 and no bug bounty was found (12 of 20).", "transparency": "Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI systems (15 of 30). The privacy policy, dated 29 August 2025, names First Mile Group, Inc. d/b/a Alloy and gives retention criteria without periods. No public DPA was found (10 of 30). Endpoints are marked deprecated in favour of the Events API and Investigations, with no dates (8 of 20). The security page says the data centre is in the United States. No sub-processor list was found (5 of 20)." }, "sources": [ { "what": "developer docs index for agents", "url": "https://developer.alloy.com/public/llms.txt", "seen": "2026-10-14" }, { "what": "introduction", "url": "https://developer.alloy.com/public/docs/introduction.md", "seen": "2026-10-14" }, { "what": "authentication guide", "url": "https://developer.alloy.com/public/docs/authentication-guide.md", "seen": "2026-10-14" }, { "what": "account-level API keys", "url": "https://developer.alloy.com/public/docs/account-level-api-keys.md", "seen": "2026-10-14" }, { "what": "sandbox vs production", "url": "https://developer.alloy.com/public/docs/sandbox-vs-production.md", "seen": "2026-10-14" }, { "what": "error codes", "url": "https://developer.alloy.com/public/docs/_errors.md", "seen": "2026-10-14" }, { "what": "request handling and retries", "url": "https://developer.alloy.com/public/docs/request-handling-retry.md", "seen": "2026-10-14" }, { "what": "webhook best practices", "url": "https://developer.alloy.com/public/docs/best-practices.md", "seen": "2026-10-14" }, { "what": "webhook retry logic", "url": "https://developer.alloy.com/public/docs/retry-logic-and-webhook-logs.md", "seen": "2026-10-14" }, { "what": "run an evaluation reference with OpenAPI fragment", "url": "https://developer.alloy.com/public/reference/post_evaluations.md", "seen": "2026-10-14" }, { "what": "Web SDK changelog", "url": "https://developer.alloy.com/public/docs/web-sdk-changelog.md", "seen": "2026-10-14" }, { "what": "understanding API rate limits", "url": "https://help.alloy.com/en/articles/16764579-understanding-api-rate-limits", "seen": "2026-10-14" }, { "what": "status incidents (JSON)", "url": "https://status.alloy.com/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "security page", "url": "https://www.alloy.com/security", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.alloy.com/privacy-policy", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://www.alloy.com/tos", "seen": "2026-10-14" }, { "what": "product updates", "url": "https://www.alloy.com/product-updates", "seen": "2026-10-14" }, { "what": "npm @alloyidentity/web-sdk", "url": "https://registry.npmjs.org/@alloyidentity/web-sdk", "seen": "2026-10-14" } ], "openQuestions": [ "Alloy's Terms of Service forbid robots, crawlers and scraping of the site or services, including for training AI. We read public pages, as the brief says, and record the clause here", "Whether any sandbox or trial is open without a contract. None was found on public pages", "Whether an SLA, DPA or sub-processor list exists for customers. None was found on public pages", "No official MCP server. The registry's alloy entries belong to unrelated companies", "The security page's SOC 2 Type 2 statement carries no report date" ] }, "negative": 0, "verdict": "Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.", "bestFor": "Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.", "strengths": [ "Public developer docs with llms.txt (247 entries), Markdown pages and an OpenAPI fragment on each reference page", "Rate-limit headers and `retry-after` on 429, with a written guide to which codes to retry", "One API orchestrates identity, business, document and watchlist checks across many data vendors", "Up to five active secrets per key, OAuth client credentials and an IP allowlist", "Status page with separate Production API, Sandbox API, Webhooks and third-party components" ], "weaknesses": [ "No public prices, trial or self-serve sign-up. Access starts with a demo request", "Rate limits vary by account and endpoint with no published numbers", "No idempotency key and no server-side SDK", "Evaluation inputs and outputs depend on each customer's workflow, so the contract is loosely typed", "Sandbox and Production are request modes over one data store, so test and live records can collide" ], "agentNotes": [ "Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts", "Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store", "Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter", "Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting", "Send the workflow header with account-level keys, since inputs depend on the workflow configured" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.4 } ], "editorialScores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 38 }, "provenanceScore": 86 }, "connect": { "http": "curl -X POST https://sandbox.alloy.co/v1/oauth/bearer \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Basic \u003cbasic_token\u003e\" \\\n -d '{\n \"grant_type\": \"client_credentials\"\n }'" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/alloy" }, "notable": [ "Sandbox and Production are per-request modes over one shared data store, so external identifiers collide across them unless prefixed (https://developer.alloy.com/public/docs/sandbox-vs-production)", "Rate limits vary by endpoint and account, with `alloy-ratelimit-*` and `retry-after` headers (https://help.alloy.com/en/articles/16764579-understanding-api-rate-limits)", "Journey application calls return within about 25 seconds and may come back `running`, with the result sent by webhook (https://developer.alloy.com/public/docs/request-handling-retry)", "Webhooks retry ten times over 24 hours and are disabled after 100 consecutive failures in 72 hours (https://developer.alloy.com/public/docs/retry-logic-and-webhook-logs)", "status.alloy.com lists elevated Journeys API errors on 21 July 2026 among nine incidents since 17 July (https://status.alloy.com)", "The terms of service forbid robots, crawlers and scraping of the site or services (https://www.alloy.com/tos)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "Alloy API v1 as documented on developer.alloy.com/public. No official MCP server found" }, { "label": "Base URLs", "value": "https://api.alloy.co and https://sandbox.alloy.co, or https://{account_slug}.api.alloy.com and .sandbox.alloy.com. Some accounts outside the US have their own hosts" }, { "label": "Resources", "value": "Journeys and journey applications, evaluations, entities and entity groups, documents, bank accounts, events, batches, custom lists, cases (deprecated) and investigations, AI analysis summaries, diagnostics" }, { "label": "Credentials", "value": "Token and secret as basic auth, or OAuth client credentials for a one-hour bearer token. Up to five secrets per key. IP allowlist" }, { "label": "Rate limits", "value": "Per endpoint, method, environment and account, no published figures. `alloy-ratelimit-limit`, `-remaining`, `-reset` and `retry-after` headers" }, { "label": "Errors", "value": "`status_code`, `error.minor_code`, `type`, `message`, `details`, `error_token`. 206 partial response resumable by PATCH. 429 minor code 4033" }, { "label": "Webhooks", "value": "10-second timeout, ten retries over 24 hours, unordered and possibly duplicated, disabled after 100 failures in 72 hours" }, { "label": "SDKs", "value": "Web SDK @alloyidentity/web-sdk 2.16.0 and an Android web SDK for document capture. No server-side client" }, { "label": "Status", "value": "status.alloy.com on Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations" }, { "label": "Certifications", "value": "SOC 2 Type 2 per the security page. Yearly third-party penetration tests. Disclosure by email" } ], "provenance": { "legalEntity": "First Mile Group, Inc.", "domain": "alloy.com", "domainRegistered": "1999-02-25", "endpointOnVendorDomain": true, "terms": "https://www.alloy.com/tos", "privacy": "https://www.alloy.com/privacy-policy", "statusPage": "https://status.alloy.com", "changelog": "https://www.alloy.com/product-updates", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The privacy policy (29 August 2025) names First Mile Group, Inc. d/b/a/ Alloy.", "The default API hosts are on alloy.co (api.alloy.co, sandbox.alloy.co), and account-specific hosts on alloy.com. status.alloy.co redirects to status.alloy.com.", "www.alloy.com/.well-known/security.txt and alloy.co/.well-known/security.txt return 404.", "RDAP for alloy.com gives a registration date of 1999-02-25, before Alloy was founded in 2015." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "First Mile Group, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "alloy.com, registered 1999-02-25 (27 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "alloy.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.alloy.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.alloy.com/tos", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-03-12", "words": 4679, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated Date: March 12, 2026", "says": "Last updated 2026-03-12" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The terms of this Agreement are governed by and shall be construed in accordance with the laws of the United States (including federal arbitration law) and the State of New York, U.S.A., without regard to its principles of conflicts of law, and regardless of your location.", "says": "The law of the United States" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "and (d) the maximum aggregate liability of Alloy for all damages, losses and causes of action, whether in contract, tort (including negligence) or otherwise, shall be the greater of the total amount, if any, paid by you to Alloy to use the Site or fifty U.S." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Sections 2–8 and 10–21 shall survive any expiration or termination of this Agreement." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We may change this Agreement from time to time without prior notice or by notifying you of such changes by any reasonable means, including by posting a revised Agreement through the Site.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You may not use our trade names, trademarks, service marks or logos in connection with any product or service that is not ours, or in any manner that is likely to cause confusion." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Use any robot, spider, crawler, site search/retrieval application or other manual or automatic data gathering or extraction tools to access, acquire, copy, monitor, aggregate, retrieve, index, “scrape,” “data mine” or otherwise gather any Site content or any portion of the Site or the Services", "costsPoints": true }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "…tort, statute, fraud, misrepresentation or any other legal theory, will be resolved through final and binding arbitration before a neutral arbitrator instead of in a court by a judge or jury, and you agree that Alloy and you are each waiving the right to trial by a jury." } ], "notes": [ { "date": "2026-10-14", "text": "Users grant Alloy a perpetual, irrevocable, sublicensable licence to use and exploit their submissions for any purpose, including promotional purposes such as testimonials.", "quote": "create derivative works of, adapt, modify and otherwise use, analyze and exploit such Submission, in any format or media now known or hereafter developed, and for any purpose (including promotional purposes, such as testimonials)." }, { "date": "2026-10-14", "text": "Gathering site or Services content to develop, train, test or improve any machine learning or AI system is prohibited.", "quote": "including to (a) directly or indirectly, develop, train, test or improve any software tool, service, machine learning algorithm or artificial intelligence system or platform, including any architecture, models or weights" }, { "date": "2026-10-14", "text": "Alloy reports, insights and scores may not be used as a factor in deciding eligibility for credit, insurance or employment.", "quote": "No reporting, insights, analysis, or proprietary evaluation scores generated by Alloy may be used in whole or in part as a factor in determining eligibility for credit, insurance, employment or another purpose in connection with which a consumer report may be used under the FCRA" } ] }, { "kind": "privacy", "url": "https://www.alloy.com/privacy-policy", "state": "read", "readAt": "2026-10-14", "words": 5477, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Information We Collect About Visitors and Client Representatives From Other Sources" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We may store information about you for as long as we have a legitimate business need for it." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers: We engage vendors to perform specific business functions on our behalf, and they may receive information about you from us or collect it directly." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "To exercise this right, please visit our Do Not Sell or Share My Personal Information webpage or contact us.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Your rights under the GDPR for data we process as a controller: If you are located in the European Economic Area (“EEA”), U.K., or Switzerland, you have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Should you have any questions regarding our security procedures or wish to report any potential system failures or breaches, please contact us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Transfers: Obtain information about and a copy of the safeguards, including the standard contractual clauses, we use to transfer personal data across borders.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share your information with business partners, online advertising partners, and social media platforms for this purpose." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/alloy.json", "live": { "slug": "alloy", "vendorStatus": { "page": "https://status.alloy.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:51.209484803Z" }, "mcpTools": { "url": "https://api.alloy.cx/mcp", "checkedAt": "2026-10-02T22:09:59.902886223Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-02T22:09:59.902886223Z" }, "updatedAt": "2026-10-14T09:38:51.209484803Z" } }, "verify": { "accepts": "a page on alloy.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/alloy.svg", "body": { "slug": "alloy", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/alloy", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/alloy\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/alloy.svg\" alt=\"Alloy on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Alloy on Anchor Terminal](https://www.anchorterminal.com/badges/alloy.svg)](https://www.anchorterminal.com/tools/alloy)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/alloy\"\u003eAlloy on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/alloy", "json": "https://www.anchorterminal.com/tools/alloy.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/alloy.md", "slim": "https://www.anchorterminal.com/tools/alloy.min.md" }, "markdown": "## Overview\n\n**Grade D · 52.4/100 · rank #782 of 1076 · #16 in Identity \u0026 business verification · not agent-ready · confidence medium**\n\n\n## Assessment\n\nAlloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | First Mile Group, Inc. (Alloy) (https://www.alloy.com) |\n| Kind | HTTP API |\n| Category | Identity \u0026 business verification (https://www.anchorterminal.com/categories/identity-verification) |\n| Transport | HTTP |\n| Auth | OAuth or key · Account-level token and secret (older accounts use a workflow token and secret), sent as HTTP basic auth or exchanged at /v1/oauth/bearer for a one-hour Bearer token with client credentials. Up to five active secrets per key, rotated and revoked in the dashboard by users with key permissions. No scopes. The same keys serve sandbox and production, chosen by base URL or the `alloy-sandbox: true` header. Keys come with a customer contract (checked 2026-10-14). |\n| Pricing | Paid (Paid) · No public prices. www.alloy.com/pricing returns 404 and the site routes buyers to a demo. Production calls invoke third-party data vendors and can incur charges, while sandbox calls don't (https://developer.alloy.com/public/docs/sandbox-vs-production, checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the developer docs index, the API reference or the website (checked 2026-10-14). |\n| Licence | Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT |\n| Packages | npm: `@alloyidentity/web-sdk` |\n| Docs | https://developer.alloy.com/public/docs/introduction |\n| llms.txt | https://developer.alloy.com/public/llms.txt |\n| Last release | 2026-10-05 |\n| npm downloads / week | 20,569 |\n| Surface graded | Alloy API v1 as documented on developer.alloy.com/public. No official MCP server found |\n| Base URLs | https://api.alloy.co and https://sandbox.alloy.co, or https://{account_slug}.api.alloy.com and .sandbox.alloy.com. Some accounts outside the US have their own hosts |\n| Resources | Journeys and journey applications, evaluations, entities and entity groups, documents, bank accounts, events, batches, custom lists, cases (deprecated) and investigations, AI analysis summaries, diagnostics |\n| Credentials | Token and secret as basic auth, or OAuth client credentials for a one-hour bearer token. Up to five secrets per key. IP allowlist |\n| Rate limits | Per endpoint, method, environment and account, no published figures. `alloy-ratelimit-limit`, `-remaining`, `-reset` and `retry-after` headers |\n| Errors | `status_code`, `error.minor_code`, `type`, `message`, `details`, `error_token`. 206 partial response resumable by PATCH. 429 minor code 4033 |\n| Webhooks | 10-second timeout, ten retries over 24 hours, unordered and possibly duplicated, disabled after 100 failures in 72 hours |\n| SDKs | Web SDK @alloyidentity/web-sdk 2.16.0 and an Android web SDK for document capture. No server-side client |\n| Status | status.alloy.com on Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations |\n| Certifications | SOC 2 Type 2 per the security page. Yearly third-party penetration tests. Disclosure by email |\n| Capabilities | kyc.identity, kyc.business, kyc.screening, kyc.documents, kyc.cases |\n| Tags | hosted, enterprise, sales-led, api-key, oauth, llms-txt, webhooks, sandbox, status-page, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/alloy.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 59 | 11.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 73 | 11.9 |\n| Agent ergonomics | 13% | 16.2 | 52 | 8.4 |\n| Security \u0026 auth | 14% | 17.5 | 49 | 8.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 0 | 0.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 72 | 6.3 |\n| Transparency \u0026 trust (editorial 38, provenance 86) | 7% | 8.8 | 62 | 5.4 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **52.4 → D** |\n\n### Why each score\n\n- Reliability 59: Read with the hosted lines. status.alloy.com is a Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations components (20). Nine incidents between 17 July and 9 October 2026, four labelled major. Elevated error rates on the Journeys API on 21 July, resolved within about an hour, hit the Production API. The others marked major were a Socure document verification failure through the SDK on 10 September (about 4.5 hours), a Loqate address formatter outage on 20 August and a 9-minute dashboard login problem on 17 July. We scored 10 because only one major touched the API itself (10). Limits are set per endpoint and account with no published numbers, and responses carry `alloy-ratelimit-limit`, `-remaining` and `-reset` headers (7 of 15). A 429 carries `retry-after`, and the retry guide names retryable codes and asks for exponential backoff with jitter. No idempotency key for writes was found (12 of 15). No SLA found (0). The API is generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 73: Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). llms.txt with 247 entries and a Markdown copy of each page (10). Descriptions explain each endpoint and flag deprecated ones, but the evaluations endpoint says inputs vary with each workflow's configuration (13 of 20). Typed schemas where the payload is fixed, and dynamic bodies for evaluations and journeys (9 of 15). curl examples, and an error table with an HTTP code and a minor code for each case (13 of 15). A v1 path and dated Web SDK changelog entries, with product updates on the marketing site. No API changelog was found (8 of 15).\n- Agent ergonomics 52: No field selection, and evaluation and journey responses return the full decision payload (10 of 25). Paginated lists for batches, cases and investigations, with filters on cases (14 of 20). Errors carry `status_code`, `minor_code`, `type`, `message`, `details` and an `error_token`, with a documented table (18 of 20). No idempotency key. Journey application reruns are explicit endpoints, and the webhook guide asks receivers to handle duplicates (6 of 20). No server-side SDK. The npm and Android packages are capture SDKs for the end-user document step (4 of 15).\n- Security \u0026 auth 49: An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. Up to five active secrets per key, with rotation and revocation in the dashboard. No scopes were found, and the bearer token has the same access as the key (20 of 30). An IP allowlist exists (error 4016) and dashboard roles govern who manages keys. No read-only key (7 of 20). Responses carry data returned by third-party vendors and AI analysis summaries, with no injection guidance (3 of 15). Webhook logs and dashboard records, with no API audit log found (7 of 15). The security page says Alloy is SOC 2 Type 2 certified, runs yearly penetration tests and takes vulnerability reports by email. security.txt returns 404 and no bug bounty was found (12 of 20).\n- Payments \u0026 pricing 0: Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. www.alloy.com/pricing returns 404 and the site asks visitors to schedule a demo (0). No trial or free tier found. Sandbox mode exists for customers (0). Access is through sales (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 72: Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). Web SDK 2.12.0, 2.13.0 and 2.14.0 in September plus 2.16.0 in October (20). A closed service with a help centre, a product updates page and an AI support chat added in September. GitHub issue handling not applicable (10 of 15). The only official packages are capture SDKs, current (7 of 15). @alloyidentity/web-sdk is MIT and current. CI wasn't checked (5 of 10).\n- Transparency \u0026 trust 62: Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI systems (15 of 30). The privacy policy, dated 29 August 2025, names First Mile Group, Inc. d/b/a Alloy and gives retention criteria without periods. No public DPA was found (10 of 30). Endpoints are marked deprecated in favour of the Events API and Investigations, with no dates (8 of 20). The security page says the data centre is in the United States. No sub-processor list was found (5 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (15 items): https://www.anchorterminal.com/fixes/alloy.md (JSON https://www.anchorterminal.com/fixes/alloy.json)\n\n### What we couldn't check\n\n- Alloy's Terms of Service forbid robots, crawlers and scraping of the site or services, including for training AI. We read public pages, as the brief says, and record the clause here\n- Whether any sandbox or trial is open without a contract. None was found on public pages\n- Whether an SLA, DPA or sub-processor list exists for customers. None was found on public pages\n- No official MCP server. The registry's alloy entries belong to unrelated companies\n- The security page's SOC 2 Type 2 statement carries no report date\n\n### Sources\n\n- developer docs index for agents: \u003chttps://developer.alloy.com/public/llms.txt\u003e (seen 2026-10-14)\n- introduction: \u003chttps://developer.alloy.com/public/docs/introduction.md\u003e (seen 2026-10-14)\n- authentication guide: \u003chttps://developer.alloy.com/public/docs/authentication-guide.md\u003e (seen 2026-10-14)\n- account-level API keys: \u003chttps://developer.alloy.com/public/docs/account-level-api-keys.md\u003e (seen 2026-10-14)\n- sandbox vs production: \u003chttps://developer.alloy.com/public/docs/sandbox-vs-production.md\u003e (seen 2026-10-14)\n- error codes: \u003chttps://developer.alloy.com/public/docs/_errors.md\u003e (seen 2026-10-14)\n- request handling and retries: \u003chttps://developer.alloy.com/public/docs/request-handling-retry.md\u003e (seen 2026-10-14)\n- webhook best practices: \u003chttps://developer.alloy.com/public/docs/best-practices.md\u003e (seen 2026-10-14)\n- webhook retry logic: \u003chttps://developer.alloy.com/public/docs/retry-logic-and-webhook-logs.md\u003e (seen 2026-10-14)\n- run an evaluation reference with OpenAPI fragment: \u003chttps://developer.alloy.com/public/reference/post_evaluations.md\u003e (seen 2026-10-14)\n- Web SDK changelog: \u003chttps://developer.alloy.com/public/docs/web-sdk-changelog.md\u003e (seen 2026-10-14)\n- understanding API rate limits: \u003chttps://help.alloy.com/en/articles/16764579-understanding-api-rate-limits\u003e (seen 2026-10-14)\n- status incidents (JSON): \u003chttps://status.alloy.com/api/v2/incidents.json\u003e (seen 2026-10-14)\n- security page: \u003chttps://www.alloy.com/security\u003e (seen 2026-10-14)\n- privacy policy: \u003chttps://www.alloy.com/privacy-policy\u003e (seen 2026-10-14)\n- terms of service: \u003chttps://www.alloy.com/tos\u003e (seen 2026-10-14)\n- product updates: \u003chttps://www.alloy.com/product-updates\u003e (seen 2026-10-14)\n- npm @alloyidentity/web-sdk: \u003chttps://registry.npmjs.org/@alloyidentity/web-sdk\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 86/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | First Mile Group, Inc. | 20/20 |\n| Domain age | alloy.com, registered 1999-02-25 (27 years) | 15/15 |\n| Endpoint on the vendor's domain | alloy.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 1 clause that costs points | 7.1/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | status.alloy.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe privacy policy (29 August 2025) names First Mile Group, Inc. d/b/a/ Alloy.\n\nThe default API hosts are on alloy.co (api.alloy.co, sandbox.alloy.co), and account-specific hosts on alloy.com. status.alloy.co redirects to status.alloy.com.\n\nwww.alloy.com/.well-known/security.txt and alloy.co/.well-known/security.txt return 404.\n\nRDAP for alloy.com gives a registration date of 1999-02-25, before Alloy was founded in 2015.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.alloy.com/tos), read 2026-10-14, dated 2026-03-12, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Use any robot, spider, crawler, site search/retrieval application or other manual or automatic data gathering or extraction tools to access, acquire, copy, monitor, aggregate, retrieve, index, “scrape,” “data mine” or otherwise gather any Site content or any portion of the Site or the Services\"\n- To know. Requires arbitration or waives class actions. \"…tort, statute, fraud, misrepresentation or any other legal theory, will be resolved through final and binding arbitration before a neutral arbitrator instead of in a court by a judge or jury, and you agree that Alloy and you are each waiving the right to trial by a jury.\"\n- Gives the date it was last updated. Last updated 2026-03-12.\n- Names the governing law or courts. The law of the United States.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-14). Users grant Alloy a perpetual, irrevocable, sublicensable licence to use and exploit their submissions for any purpose, including promotional purposes such as testimonials. \"create derivative works of, adapt, modify and otherwise use, analyze and exploit such Submission, in any format or media now known or hereafter developed, and for any purpose (including promotional purposes, such as testimonials).\"\n- Also in the text (2026-10-14). Gathering site or Services content to develop, train, test or improve any machine learning or AI system is prohibited. \"including to (a) directly or indirectly, develop, train, test or improve any software tool, service, machine learning algorithm or artificial intelligence system or platform, including any architecture, models or weights\"\n- Also in the text (2026-10-14). Alloy reports, insights and scores may not be used as a factor in deciding eligibility for credit, insurance or employment. \"No reporting, insights, analysis, or proprietary evaluation scores generated by Alloy may be used in whole or in part as a factor in determining eligibility for credit, insurance, employment or another purpose in connection with which a consumer report may be used under the FCRA\"\n\n**Privacy policy** (https://www.alloy.com/privacy-policy), read 2026-10-14, gives no date, states 7 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"We may share your information with business partners, online advertising partners, and social media platforms for this purpose.\"\n- Not found in the text. Gives the date it was last updated.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. Gives an email address, hidden from our reader by the page.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n\n## Live (updated 2026-10-14 09:38 UTC)\n\n- Vendor status page: none, All Systems Operational\n- Tools: the endpoint asks for credentials before listing them (checked 2026-10-02 22:09 UTC)\n- Always current: https://www.anchorterminal.com/api/v1/live/alloy.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Public developer docs with llms.txt (247 entries), Markdown pages and an OpenAPI fragment on each reference page\n- Rate-limit headers and `retry-after` on 429, with a written guide to which codes to retry\n- One API orchestrates identity, business, document and watchlist checks across many data vendors\n- Up to five active secrets per key, OAuth client credentials and an IP allowlist\n- Status page with separate Production API, Sandbox API, Webhooks and third-party components\n\n## Weaknesses\n\n- No public prices, trial or self-serve sign-up. Access starts with a demo request\n- Rate limits vary by account and endpoint with no published numbers\n- No idempotency key and no server-side SDK\n- Evaluation inputs and outputs depend on each customer's workflow, so the contract is loosely typed\n- Sandbox and Production are request modes over one data store, so test and live records can collide\n\n## Before you call it (notes for agents)\n\n1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts\n2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store\n3. Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter\n4. Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting\n5. Send the workflow header with account-level keys, since inputs depend on the workflow configured\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST https://sandbox.alloy.co/v1/oauth/bearer \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Basic \u003cbasic_token\u003e\" \\\n -d '{\n \"grant_type\": \"client_credentials\"\n }'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/alloy. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Didit | BB | 75 | 63 | kyc.identity, kyc.documents, kyc.screening, kyc.business, kyc.cases | no | https://www.anchorterminal.com/tools/didit.md |\n| Persona | B | 69.5 | 192 | kyc.identity, kyc.business, kyc.documents, kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/persona.md |\n| Sumsub | B | 68.5 | 220 | kyc.identity, kyc.business, kyc.documents, kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/sumsub.md |\n| Socure RiskOS | B | 63.5 | 417 | kyc.identity, kyc.documents, kyc.screening, kyc.business, kyc.cases | no | https://www.anchorterminal.com/tools/socure-riskos.md |\n| ComplyCube | B | 63.7 | 403 | kyc.identity, kyc.documents, kyc.screening, kyc.business | no | https://www.anchorterminal.com/tools/complycube.md |\n| Middesk | C | 59 | 596 | kyc.business, kyc.screening, kyc.cases, kyc.identity | no | https://www.anchorterminal.com/tools/middesk.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Sandbox and Production are per-request modes over one shared data store, so external identifiers collide across them unless prefixed (source: \u003chttps://developer.alloy.com/public/docs/sandbox-vs-production\u003e)\n- Rate limits vary by endpoint and account, with `alloy-ratelimit-*` and `retry-after` headers (source: \u003chttps://help.alloy.com/en/articles/16764579-understanding-api-rate-limits\u003e)\n- Journey application calls return within about 25 seconds and may come back `running`, with the result sent by webhook (source: \u003chttps://developer.alloy.com/public/docs/request-handling-retry\u003e)\n- Webhooks retry ten times over 24 hours and are disabled after 100 consecutive failures in 72 hours (source: \u003chttps://developer.alloy.com/public/docs/retry-logic-and-webhook-logs\u003e)\n- status.alloy.com lists elevated Journeys API errors on 21 July 2026 among nine incidents since 17 July (source: \u003chttps://status.alloy.com\u003e)\n- The terms of service forbid robots, crawlers and scraping of the site or services (source: \u003chttps://www.alloy.com/tos\u003e)\n\n- #16 of 16 in Best identity and business verification APIs for AI agents: https://www.anchorterminal.com/best/identity-verification/index.md\n- All 119 verification comparisons: https://www.anchorterminal.com/compare/identity-verification/index.md\n\n## Compare\n\n- [Alloy vs ComplyCube](https://www.anchorterminal.com/compare/alloy-vs-complycube.md): D 52.4 vs B 63.7\n- [Alloy vs Didit](https://www.anchorterminal.com/compare/alloy-vs-didit.md): D 52.4 vs BB 75\n- [Alloy vs Entrust Identity Verification (formerly Onfido)](https://www.anchorterminal.com/compare/alloy-vs-entrust-identity-verification.md): D 52.4 vs B 62.1\n- [Alloy vs Jumio](https://www.anchorterminal.com/compare/alloy-vs-jumio.md): D 52.4 vs C 55\n- [Alloy vs Middesk](https://www.anchorterminal.com/compare/alloy-vs-middesk.md): D 52.4 vs C 59\n- [Alloy vs Persona](https://www.anchorterminal.com/compare/alloy-vs-persona.md): D 52.4 vs B 69.5\n- [Alloy vs Plaid Identity Verification](https://www.anchorterminal.com/compare/alloy-vs-plaid-identity-verification.md): D 52.4 vs B 67.1\n- [Alloy vs Shufti](https://www.anchorterminal.com/compare/alloy-vs-shufti.md): D 52.4 vs C 57.8\n- [Alloy vs Socure RiskOS](https://www.anchorterminal.com/compare/alloy-vs-socure-riskos.md): D 52.4 vs B 63.5\n- [Alloy vs Stripe Identity](https://www.anchorterminal.com/compare/alloy-vs-stripe-identity.md): D 52.4 vs BB 77.7\n- [Alloy vs Sumsub](https://www.anchorterminal.com/compare/alloy-vs-sumsub.md): D 52.4 vs B 68.5\n- [Alloy vs Trulioo](https://www.anchorterminal.com/compare/alloy-vs-trulioo.md): D 52.4 vs C 58.2\n- [Alloy vs Veriff](https://www.anchorterminal.com/compare/alloy-vs-veriff.md): D 52.4 vs C 61.1\n- [Alloy vs Vouched](https://www.anchorterminal.com/compare/alloy-vs-vouched.md): D 52.4 vs C 56.4\n- [Alloy vs ComplyAdvantage](https://www.anchorterminal.com/compare/alloy-vs-complyadvantage.md): D 52.4 vs D 52.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on alloy.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"alloy\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/alloy\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/alloy.svg\" alt=\"Alloy on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Alloy on Anchor Terminal](https://www.anchorterminal.com/badges/alloy.svg)](https://www.anchorterminal.com/tools/alloy)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/alloy\"\u003eAlloy on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Alloy is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/alloy-dark.png\n- Light: https://www.anchorterminal.com/assets/share/alloy-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=alloy\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Identity \u0026 business verification", "url": "https://www.anchorterminal.com/categories/identity-verification" }, { "name": "Alloy", "url": "" } ], "description": "Alloy is an identity and fraud decisioning platform for banks and fintechs. Its API runs onboarding journeys and evaluations that orchestrate identity, business, document and watchlist checks across third-party data vendors, with case management and ongoing monitoring.", "facts": [ "rank #782 of 1076", "OAuth or key auth", "0 desk reviews" ], "h1": "Alloy", "image": "https://www.anchorterminal.com/assets/og/tools-alloy.png", "path": "/tools/alloy", "published": "2026-10-01", "section": "tools", "title": "Alloy review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/alloy" }, "tokens": { "markdown": 6500, "slim": 1580 }, "version": 1 }