SYSTRAN Translate API

# Fix list: SYSTRAN Translate API

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/systran, the October 2026 research run, assessed 8 October 2026. Grade E, 40 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on SYSTRAN Translate API: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 25 out of 100, up to 15 more on the total

Why it scored 25: Hosted reading of the checklist. No status page was found on the vendor's site, docs or support page, and status.systran.net and status.systransoft.com did not resolve (0). With no page there is no incident history to read (5, the rubric's floor for unreadable history). Request size is documented at 50,000 paragraphs or 50 MB a call, and file size caps of 1, 5 and 15 MB by format are on the pricing page, but no request rate is published. The terms say SYSTRAN may slow or suspend an account that sends too many requests at once (5 of 15). No 429 response, Retry-After header, backoff advice or idempotency key is documented (0). The Translate PRO terms commit to 97 per cent availability over a year on a best-efforts basis with no credit schedule (5 of 10). The API is generally available (10). Total 25.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Schema & documentation, 42 out of 100, up to 9.4 more on the total

Why it scored 42: The five reference pages are generated from Swagger definitions and show typed parameters and 60 operations, but no OpenAPI or Swagger file is linked for download, so an agent has only HTML (8 of 25). No llms.txt at docs.systran.net or www.systransoft.com, both 404 (0). Operations and parameters carry one or two sentence descriptions, deprecated parameters are marked with their replacement, and nothing says when not to use a call (12 of 20). Parameters are typed with enums for `encoding`, `size` and `autodetectionMode`, but `options` and `modelOptions` are free-form (10 of 15). Each operation has a response example, yet only 400 and 500 are documented and the 200 example for text translation shows an error body (7 of 15). Each API states a version (Translation 2.11.0, Profiles 1.8.0) and has an `apiVersion` endpoint, with no changelog found (5 of 15). Total 42.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 3. Maintenance & community, 4 out of 100, up to 8.4 more on the total

Why it scored 4: No changelog or release notes for the API were found. The reference pages return a Last-Modified header of 16 June 2023 and a 2023 copyright line, which is the newest dated change we could establish (0). No dated entries in the last 90 days (0). Support runs through contact forms and a help centre at help.systrangroup.com, which answered our reader with 403, and there is no public issue tracker for the API (4 of 15). No official SDK was found. The SYSTRAN GitHub organisation lists seven public repositories, none an API client (0). No package to assess (0). Total 4.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 4. Security & auth, 55 out of 100, up to 7.9 more on the total

Why it scored 55: Model reading of the checklist, as for the other translation listings, with training and retention in place of the least-privilege and injection lines. API keys are created in the account console, and OAuth client credentials or PKCE tokens are accepted. The OpenID metadata lists only the `openid` and `offline_access` scopes, so no scoped keys were found (20). The key is also accepted as a `?key=` query parameter (minus 10). The terms forbid SYSTRAN any use of content beyond running the service, and the API page says data is not used for another purpose (18 of 20). Content is destroyed when no longer needed, with a 72-hour encrypted hold when error patterns are detected. Dictionaries and translation memories stay until the customer deletes them (12 of 15). An administrator's usage dashboard groups consumption by user agent. No audit log was found (5 of 15). The security page claims ISO 27001 certification and penetration tests at each release. No security.txt, disclosure policy or bug bounty was found (10 of 20). Total 55.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 5. Agent ergonomics, 54 out of 100, up to 7.5 more on the total

Why it scored 54: API reading of the checklist. Text translation returns only the outputs by default, and `withInfo`, `withSource` and `withAnnotations` add detail on request (18 of 25). Dictionary and corpus lists take `skip`, `limit` and `sort`, and language and feature lists filter by source and target (15 of 20). Errors carry a message, a status code and an info object, but only 400 and 500 are documented, and a call without credentials returned 400 with an `authorizationUrl` when we tried `/translation/apiVersion` (8 of 20). No idempotency key or retry guidance. File jobs return a `requestId` that can be polled and cancelled (5 of 20). Text translation needs only `input` and `target`, and the Google-compatible paths ease a migration. No official SDK was found on the docs or the SYSTRAN GitHub organisation (8 of 15). Total 54.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 6. Payments & pricing, 40 out of 100, up to 7.5 more on the total

Why it scored 40: No x402, MPP or L402 (0). The developer pricing page shows €14.99 for 1 million characters, billed monthly, without a login. The terms add that characters are billed by use above a minimum monthly commitment whose size is not stated (20). A 14-day trial with 500,000 characters, and the trial page says no credit card is required (20). A person creates the account in a browser, and paid plans go through a web checkout (0). Total 40.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 7. Transparency & trust, 51 out of 100, up to 4.3 more on the total

Made of editorial 47, provenance 54.

Why it scored 51: Closed service under published terms that name SYSTRAN SAS and took effect on 1 May 2023 (15). The terms state retention and European Union hosting, but there is no privacy policy for the product. The link in the terms opens a legal notice published by ChapsVision, which points to the group's general policy. The API page mentions servers in Europe and the Americas, which does not match the terms, and translating personal data needs a separate data protection agreement (14 of 30). The terms promise one month's email notice before an API version is deactivated and no breaking changes within a version. Deprecated parameters are marked without dates (12 of 20). The hosting provider is not named and no sub-processor list for the service was found (6 of 20). Total 47.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points (4.3 of 10)
- Privacy policy: not found (0 of 10)
- Status page: not found (0 of 10)
- Changelog: not found (0 of 10)
- security.txt: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the help centre at help.systrangroup.com, which answered 403, so support articles, any release notes and any rate limit stated there were not read.
- unchecked: anything behind the account, including the key console, whether keys can be revoked or rotated, the size of the minimum monthly commitment and the dollar price.
- `lastRelease` is the Last-Modified date of the reference pages, 16 June 2023. The service may have changed since without a public record.
- `unitPrices` is empty because the only price our reader saw is in euros (€14.99 per 1 million characters) and we don't convert.
- No privacy policy for the product was found, so `provenance.privacy` is left out. The terms' link leads to a legal notice and ChapsVision's group policy.
- The terms bar benchmark tests and automated access beyond normal human volumes. Recorded as a fact with no deduction, and it matters before our probes run.
- The terms name SYSTRAN SAS and the site's legal notice names Chapsvision SAS. Which entity contracts for new API subscriptions today is not stated.
- The lead said access needs an API or Infinite subscription. The user guide adds Premium, and the pricing page shows a 14-day trial for the API.

## Weaknesses

- The terms forbid benchmark tests and automated access that exceeds normal human volumes, which matters for any agent workload
- No status page, changelog, llms.txt, SDK or downloadable OpenAPI file was found, and the reference pages were last modified on 16 June 2023
- No request rate limit, 429 response or retry guidance is documented. Only 400 and 500 appear in the reference
- The API key may travel in the URL as `?key=`, and no key scopes were found
- No privacy policy for the product. The terms link to a legal notice that points to ChapsVision's group policy

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key as `Authorization: Key <api_key>` and avoid the documented `?key=` query option, which puts the secret in URLs and logs
- Expect HTTP 400, not 401, when credentials are missing. The body reads `No key / credentials provided`
- Call `/translation/file/translate` with `async=true` for large files, then poll `/translation/file/status` and fetch `/translation/file/result` with the returned `requestId`
- Apply dictionaries and translation memories through a profile and pass its UUID as `profile`. `withDictionary` and `withCorpus` are deprecated
- Read the terms before automating. They bar benchmark tests and request volumes beyond normal human use, and SYSTRAN may throttle or suspend access

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.