CARTO

PARTIAL consensus from 1 PASS, 2 PARTIAL.

The token and SQL steps are complete, but the quickstart hard-codes the US-East direct host while the base-URL page requires the organization-specific host. The quickstart gives a complete runnable path (token scopes, connection carto_dw, allow all sources, then a copy-pasteable curl), but its SQL example calls the host direct-gcp-us-east1.api.carto.com while the API reference and the API Base URL page both give gcp-us-east1.api.carto.com for United States East, and the direct- prefix is defined nowhere in the docs. Creating an API Access Token and running a SQL API query is fully documented with step-by-step UI guidance and a curl example.

PARTIAL consensus from 3 PARTIAL.

The docs give matching per-IP ceilings and annual API weights, but they publish only a 35-300 monthly M2M range and no numeric API Access Token entitlement by plan. Scopes and values are consistent , the per-IP per-minute table (Maps 3500, LDS 3000, SQL 2500, Imports 500, Tokens & Accounts 300, Connections/Workflows/Org Maps 300, AI 300, all others 1000) appears identically on two pages, and annual quota weights are given as Maps 0.2, SQL 10, SQL Widgets 1, Import 10, LDS 0.1, all other APIs 0 , but the answer must be assembled from three separate pages, and the organization-level API Access Token quota is described as plan-dependent with no per-plan value stated anywhere. Per-IP request limits and API quota weights are documented precisely and consistently. Plan-dependent token quotas are vague (an example '100 out of 100 tokens' with no per-plan breakdown; M2M token minting stated as '35-300 tokens/month, depending on your plan' without plan-specific numbers).

FAIL consensus from 3 FAIL.

The docs identify the 429 trigger but state no block duration, retry timing, or rate-safe retry procedure. The docs state the trigger and the 429 response but never state how long the temporary block lasts, never mention a Retry-After header, and give no retry or backoff timing; prevention guidance exists (stay under the per-minute ceiling, let the CDN serve repeats, reuse M2M tokens, email support@carto.com for a higher limit), and CARTO's own documentation ask endpoint confirmed the gap rather than inventing a value, replying that the docs "do not specify how long the block lasts". The docs state that a 429 is returned and the IP is 'automatically and temporarily blocked', but do not specify the block duration, any Retry-After header, recommended retry timing, or a safe correction strategy.

PASS consensus from 2 PASS, 1 PARTIAL.

The exchange and bearer call are documented, but M2M setup pages disagree on whether creation needs only a name or also two URLs. The full path is documented end to end and agrees across pages: create an M2M OAuth Client and copy its Client ID and Secret, exchange them at auth.carto.com/oauth/token with grant_type=client_credentials and audience=carto-cloud-native-api (identical parameters shown again as working code in the integration guide), receive a token valid for 24 hours that is meant to be cached and reused, then call any API with Authorization: Bearer; the Enterprise Large plan requirement is disclosed up front. Creating an M2M OAuth Client, exchanging credentials for an access token, and using it with CARTO APIs is fully documented end-to-end across three consistent pages.

PARTIAL consensus from 1 PASS, 2 PARTIAL.

The example builds a dataset layer, but it imports vectorTableSource from @deck.gl/carto while current release guidance directs data-source imports to @carto/api-client. A minimum dataset visualization exists and its authentication matches current guidance (apiBaseUrl plus API Access Token plus connectionName), but the guide imports vectorTableSource from @deck.gl/carto while the data-sources reference and key-concepts pages both import it from @carto/api-client, and the guide's install line reads npm install maplibre-gl @deck.gl/core @deck.gl/carto with no @carto/api-client at all, so following it verbatim conflicts with the current documented package split. The Hello World example uses @deck.gl/carto ^9.2.0 with vectorTableSource and VectorTileLayer. It authenticates with VITE_API_ACCESS_TOKEN and VITE_API_BASE_URL, matching the documented API Access Token approach and API Base URL guidance.