Vapi

PASS consensus from 2 PASS, 1 PARTIAL.

One dashboard sequence creates and publishes an assistant, connects a free number, and starts inbound or outbound calls. The Dashboard path is complete and unambiguous end to end, but the TypeScript tab on the same page places the outbound call with a nested "assistant: { assistantId: 'your-assistant-id' }" payload while the Web quickstart and the Create Call API reference both use a top-level assistantId, so the code path an agent copies contradicts the reference. Four sequential sections (Create an assistant, Connect a phone number, Test an inbound call, Test an outbound call) give a single unambiguous path from zero through inbound and outbound calls.

PASS consensus from 2 PASS, 1 PARTIAL.

One guide states 10 default slots, defines three subscriptionLimits fields, and explains custom, add-on, and enterprise capacity. One page gives the default value, the three subscriptionLimits fields (concurrencyBlocked, concurrencyLimit, remainingConcurrentCalls) with per-field definitions, the org-level scope, the dashboard control that raises reserved capacity, and the 50,000 minutes per month threshold that moves an account to custom or add-on plans. The default concurrency (10) and the subscriptionLimits fields (concurrencyBlocked, concurrencyLimit, remainingConcurrentCalls) are documented. But plan-dependent capacity rules beyond 'Enterprise plans can include unlimited concurrency' are absent, no intermediate-plan tier limits are stated, and API request rate limits are only shown as a read-only dashboard field without documented values.

PASS consensus from 3 PASS.

The ended-reason table identifies both provider 429 patterns, their cause, and two direct corrections. The ended-reason page names the exact code, explains that the status code embedded in the reason string identifies the failing provider layer, distinguishes BYOK credential or quota faults from Vapi platform faults, and the troubleshooting page adds the durable correction of configuring fallback transcriber, voice, and model providers so a non-fatal error swaps providers instead of ending the call. The docs identify the specific error patterns for provider rate-limit/quota (429/exceeded-quota) with a clear correction path: upgrade provider plan/reduce volume, and configure fallback providers for resilience.

SPLIT consensus from 1 PASS, 1 PARTIAL, 1 FAIL.

The docs configure HMAC credentials but never define signed bytes, signature encoding, timestamp handling, or receiver verification code. Setting the Server URL and receiving the status-update payload are fully documented, but the HMAC section only lists the dashboard fields to fill in (Secret Key, Algorithm, Signature Header, Timestamp Header, Payload Format) and never states what string Vapi signs, what the Payload Format choices are, or how to recompute the digest, and the only verification code in the docs is a middleware named verifyVapiSignature that is referenced without ever being defined. The complete process is documented: create an HMAC credential in the dashboard (server-authentication page), reference it via credentialId, receive status-update events at the server URL (events page), and verify the HMAC signature with a production-quality TypeScript example using timingSafeEqual.

PASS consensus from 3 PASS.

The quickstart covers installation, token authentication, and REST-matching creation; the canonical API-reference fetch exceeded the tool's 5 MB limit. Install, client construction, and assistant creation are all shown, and the SDK snippet is field-for-field identical to the cURL REST body on the same page (name, model.provider, model.model, model.messages, voice.provider, voice.voiceId, firstMessage). Installation, client authentication, and a create-assistant example are all on one page with tabbed code panels for TypeScript, Python, Java, Ruby, C#, and Go. The assistant-creation example sets name, firstMessage, model, and voice, matching the REST API shape exactly.