Vertex O Series

# Fix list: Vertex O Series

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/vertex-tax, the October 2026 research run, assessed 8 October 2026. Grade C, 54.7 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Vertex O Series: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Payments & pricing, 0 out of 100, up to 12.5 more on the total

Why it scored 0: Read with the hosted rubric. No x402, MPP or L402 in the developer docs or the specs (0). No public price. www.vertexinc.com/pricing returns 404 and the product page asks visitors to book a demo (0). No free tier or trial was found (0). The security guide says to work with the Vertex sales team to establish an account, and an administrator then creates the API credential in the web interface (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 2. Agent ergonomics, 51 out of 100, up to 8 more on the total

Why it scored 51: Calculation responses can't be trimmed by field. Three indicator flags switch optional blocks on, and configuration lists default to 20 items (12 of 25). Configuration lists take OData `$skip`, `$top` (maximum 500) and `$filter`, and Certificate Centre documents filtering and sorting. Calculation calls return one transaction (16 of 20). Errors carry `code`, `message` and `target`, but the guide lists only 400, 401, 403 and 500 with general advice (10 of 20). No idempotency key. An agent can check whether a transaction exists, then delete, reverse or roll it back, and the docs warn of duplicate transactions outside a 90-day window on Cloud (6 of 20). One required field on a calculation request. No official SDK was found, and the guides show cURL and C# samples (7 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 3. Security & auth, 57 out of 100, up to 7.5 more on the total

Why it scored 57: OAuth 2.0 client credentials. A Cloud credential maps to one API and one partition, the secret is shown once, and access tokens last 3,599 seconds. Token requests with credentials in the URL are rejected. The configuration spec names view and edit scopes, but the Cloud token returns scope `profile`, which the docs call informational, so we scored between plain revocable keys and scoped ones (22 of 30). On-Premise and On-Demand let an admin build a role with a subset of the API User role and set credential expiry in days. No read-only Cloud credential or confirmation for deletes was found (10 of 20). Responses are structured tax results and configuration records (10 of 15). No audit log of API calls was found. A request can ask for support-level log entries in its own response (2 of 15). The trust centre lists 2025 SOC 1 Type II and SOC 2 Type II reports from Forvis Mazars, annual third-party penetration testing and an ISO certificate for e-Invoicing. security.txt returns 404, and no bug bounty or disclosure policy was found (13 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 4. Reliability, 65 out of 100, up to 7 more on the total

Why it scored 65: Read with the hosted rubric. The graded surface is the O Series Cloud REST v2 API. Statuspage at status.vertexinc.com with 26 components, O Series Cloud among them (20). The incident feed shows 13 incidents from 10 July to 8 October 2026 and none names O Series Cloud. Certificate Centre had a critical disruption of 1.1 hours on 14 July, and three incidents marked major on VAT Compliance, the portal and Express Returns each lasted 1.1 hours or less (20). The token endpoint is limited to 10 requests per 8 hours and the Certificate Centre API to 1,000 requests a minute. No limit for the calculation API was found (7 of 15). Certificate Centre documents 429 and the O Series guide says to retry a 500 later. No Retry-After, backoff guidance or idempotency key was found (3 of 15). The trust centre lists a Vertex Service Level Exhibit behind an access request, which we couldn't read (5 of 10). REST v2 is generally available (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 5. Schema & documentation, 74 out of 100, up to 4.2 more on the total

Why it scored 74: OpenAPI 3.0 specs for four O Series APIs download without a login from the API reference. Calculation and Tax GIS is 2.9.0 with 14 operations and 168 schemas, Tax Configuration v2.1.0 with 29 operations (25). developer.vertexinc.com/llms.txt returns 404 and the llms.txt on www.vertexinc.com is a list of marketing pages, but each guide is served as Markdown at its URL plus .md (5 of 10). The sale operation explains Quotation, Invoice and Distribute Tax and which are stored, and the calculation spec carries 872 descriptions. None says when not to call an operation (14 of 20). 36 enums and string length limits, though `transactionType` is the only required field among 54 on a sale request (10 of 15). Guides carry sample requests and responses. The calculation spec has 2 examples, and errors are four generic statuses with no catalogue of error codes (8 of 15). The path carries v2 and specs carry versions. Release notes are grouped by service release (SR19 to SR24) without dates (12 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 6. Maintenance & community, 62 out of 100, up to 3.3 more on the total

Why it scored 62: The O Series release notes page, which now covers SR24 and calculation spec 2.9.0, was last modified on 25 September 2026. Certificate Centre lists a September 2026 release, version 1.0.3 (30). The e-Invoicing API has dated release notes for 22 July, 21 and 28 August, and 1, 4, 10 and 16 September 2026 (20). Closed service with public release notes and support through Vertex Community, which needs a login we don't have (9 of 15). No official SDK or MCP server was found. The only public repository under github.com/vertexinc is a Magento connector last pushed in April 2021 (0). Specs are synced to the docs site from a source repository per the page metadata, with no public CI to read (3 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Transparency & trust, 68 out of 100, up to 2.8 more on the total

Made of editorial 52, provenance 84.

Why it scored 68: Closed service. The only public terms are the website terms of use, which name Vertex, Inc. and Pennsylvania law. The customer agreement isn't published (10 of 30). The privacy notice, last updated 19 August 2026, says personal data is disposed of when no longer necessary and gives no periods. The trust centre says Vertex signs a DPA and deletes customer data on request, with the DPA itself behind an access request (14 of 30). A dated notice ended support for most REST v1 endpoints on 30 April 2026 with a migration guide. No general deprecation policy was found (10 of 20). Five sub-processors with locations and purpose (AWS, Microsoft, Oracle, ecosio, Global VAT Compliance), last updated 8 April 2026 (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: read, states 3 of the 7 things a reader expects (6.6 of 10)
- Privacy policy: read, states 5 of the 8 things a reader expects (7.8 of 10)
- security.txt: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the Vertex Service Level Exhibit, Security Exhibit and Data Processing Agreement, which the trust centre lists behind an access request
- unchecked: Vertex Community support and product documentation, which need a customer login
- Whether the calculation API has a request rate limit or answers 429. None was found in the O Series guides or spec
- Whether resending an INVOICE with the same documentNumber or transactionId replaces or duplicates the stored transaction
- Whether the Online Commerce sandbox host can be used without a contract
- Whether vertexsmb.com and vertexcloud.com are registered to Vertex, Inc. The vendor's docs name them as its API hosts
- The dates of O Series service releases SR19 to SR24. The release notes carry none, only the page's modification date

## Weaknesses

- No public price, free tier or self-serve signup. The security guide sends new users to the Vertex sales team for an account
- No rate limit for the calculation API and no idempotency key were found in the reviewed documentation
- The standard token endpoint allows 10 access token requests per 8 hours for each client
- No official SDK, MCP server or llms.txt on the developer site was found
- The customer agreement, DPA and Service Level Exhibit sit behind an access request in the trust centre

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Cache the access token for its 3,599-second life. The standard token endpoint allows 10 requests per 8 hours, and tokenguard.vertexcloud.com returns a cached token
- Send no `Authorization: Bearer` header to /oauth/token, and put the client id and secret in the body or a Basic header. Credentials in the URL are rejected
- Set `saleMessageType` to QUOTATION for an estimate. INVOICE is stored for reporting and remittance
- Call GET /v2/transaction-exists/{transactionid} before retrying a failed INVOICE. No idempotency key is documented
- Delete, reverse or roll back a Cloud transaction within 90 days of calculation. Later requests can cause calculation errors or duplicates

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.