Adobe Firefly API vs FLORA

Adobe Firefly API 13

Model reading. The changelog's newest entry is still Upscale going GA on 24 April 2026, 194 days before this check, so the recency line falls from 10 to 0 (cause time). The AdobeDocs repository, cloned on 4 November, has no commit after 3 June 2026 on any branch. Its last spec change, on 8 May, corrects the documented resolutionLevel values for Image 5 (2MP and auto replaced by 2.4MP) with no changelog entry, version or tag, so it isn't counted as an API change, as Adobe's PDF Services docs commits aren't. For models we look at churn and notice. No changelog entry in the 90 days from 6 August, Image 5's /v4 endpoint has no dated entry, and the Upscale GA renamed creative_upsampler_v1 and rejected the old value with 422 in the same entry (5). Public changelog and enterprise support through an account manager (6). The one official SDK, @adobe/firefly-apis 2.0.1 from 24 June 2025, still has no 2026 endpoints, and its repository's last commit is 24 June 2025 (0). The SDK repo's CI builds pull requests with the test step commented out (2). 0+5+6+0+2 = 13.

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Adobe Firefly API 0

No x402, MPP or L402 (0). No public price list, access through an enterprise contract with Adobe sales (0). No free tier (0). A person has to negotiate a contract before any key exists (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 0 is 0.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Adobe Firefly API 57

Async jobs return result URLs, not bytes (20). Variation count and size controls (15). Error codes documented in the reference, 422 for a retired model header (12). No idempotency key, though a job can be cancelled at /v3/cancel/{jobId}. Every generation is a job to poll at /v3/status/{jobId} (6). Two headers plus a token exchange before the first call. The only SDK, @adobe/firefly-apis 2.0.1, was published on 24 June 2025 and calls the synchronous /v3/images/generate, /expand and /fill paths that the changelog lists as removed on 3 October 2025. It has no Image 5, composite or upscale methods (4). The spec and the SDK repository, re-read in clones on 4 November, are unchanged on these points.

FLORA 68

MCP reading for context cost. 59 tools (56 callable by the model) with no toolsets or read-only subset; since 23 September 2026 the list is filtered to the account's access and flora_list_tools returns what the connection has (7 of 25). Cursor pagination with limit 1 to 100 on 10 REST list endpoints, history filters by workspace, project and status, include_inputs off by default, per-node and per-slide document reads, and up to 20 runs read in one call (17 of 20). One REST error envelope with code, message and field errors, retryability per code, a Flora-Request-Id, MCP failures grouped into retry now, retry later, change input and report, and retired tool names answering with their replacement (18 of 20). Idempotency-Key on every mutating REST request and a body key on Technique runs; every MCP tool carries readOnlyHint and destructiveHint annotations and spending tools are marked destructive; quote: true prices before running; the MCP create call has no idempotency key (16 of 20). Few required parameters (project_id, type, prompt, with the workspace resolved from the project) and an official TypeScript SDK and a Go CLI, but no SDK in a second language (10 of 15). 7+17+18+16+10 = 68.

Adobe Firefly API 55

Adobe's hosts were not requested on 4 November. www.adobe.com's robots.txt says automated access to the Adobe site needs Adobe's express permission, and Adobe's terms sit on that host, so developer.adobe.com and status.adobe.com were left alone, as on Adobe's other listings. status.adobe.com was drawn only by script on 1 and 2 October and no Firefly Services component was confirmed. Adobe's other listings give the same page 15 of 20 on the same evidence, so this listing is brought into line (15, from 10). The 2 October readings of Adobe's status data feed and of a third-party status mirror are withdrawn, since this run reads neither, and no history is readable (5). Default limits of 4 requests a minute and 9,000 a day per organisation, raised through an account manager, re-read on 4 November in the usage notes source in the AdobeDocs/ffs-firefly-api repository (15). The same page says a 429 comes back over the limit and advises retrying on the retry-after header or with exponential backoff. No idempotency key or safe-retry guidance was found for generation jobs, so this run's value for backoff guidance alone applies (10, from 15). No SLA published, per the 1 October check (0). Image generation and, since 24 April 2026, Upscale are GA (10). 15+5+15+10+0+10 = 55.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

Adobe Firefly API 63

Model reading of the checklist (credential, training, retention, operator visibility, programme), as model listings are read in this run, with the same total as the 1 October tool-line reading. OAuth server-to-server credentials from the Adobe Developer Console, exchanged at Adobe IMS for 24-hour bearer tokens, and client secrets that can be listed, rotated and deleted through the I/O Management API, per the Developer Console guide in the AdobeDocs clone (30). Adobe says it doesn't train Firefly on Creative Cloud or Experience Cloud subscribers' personal content, per the 2 October reading, not re-read on 4 November. The statement isn't specific to API inputs (15). No retention period for prompts, uploads or outputs. The spec gives access windows only, 7 days for uploads and one hour for result URLs (5). No per-call audit log found (0). Security programme per the 2 October check, not re-read on 4 November. security.txt valid per the provenance check, a public bug bounty on Intigriti that names Adobe Firefly, and public security bulletins, with no certification counted because the compliance list couldn't be loaded (13). osv.dev lists no advisory for @adobe/firefly-apis. 30+15+5+0+13 = 63.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.