Adobe Firefly API vs SurgePix API

Adobe Firefly API 23

The changelog's newest entry is Upscale going GA on 24 April 2026, 161 days ago (10). For models we look at churn and notice. The changelog has entries on 24 and 25 March and 24 April 2026, none in the last 90 days. The Upscale GA renamed creative_upsampler_v1 and rejected the old value with 422 in the same entry, and Image 5's /v4 endpoint has no dated changelog entry (5). Public changelog and enterprise support through an account manager (6). The one official SDK, @adobe/firefly-apis 2.0.1 from 24 June 2025, hasn't kept up with the 2026 endpoints (0). The SDK repo's CI builds pull requests with the test step commented out, and nothing has been published in 15 months (2).

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.

Adobe Firefly API 69

Closed models under Adobe's terms (15). Adobe says it doesn't train Firefly on Creative Cloud or Experience Cloud subscribers' personal content. The OpenAPI spec says uploaded images stay usable for 7 days and result download URLs expire after one hour, which are access windows rather than deletion periods. We found no retention period for prompts, uploads or outputs, and no API-specific data statement (12). The changelog dates removals and breaking changes, such as the October 2025 removal of synchronous v3 endpoints and the April 2026 Upscale rename (15). No subprocessor list or data locations found for Firefly Services (0).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Adobe Firefly API 55

status.adobe.com renders only with JavaScript, on 1 and 2 October alike. Its data feed at data.status.adobe.com answers with numbered service tokens and no names, and events from 2024, so we couldn't confirm a Firefly Services component (10) or read its history (5). IsDown tracks 199 Adobe components and lists no Adobe-posted Firefly incident in 90 days, but it doesn't break Firefly out either, so we don't count it. Default limits of 4 requests a minute and 9,000 a day per organisation, raised through an account manager (15). The usage notes say a 429 comes back over the limit and advise retrying on the retry-after header or with exponential backoff, and the OpenAPI spec declares a retry-after header (15). No SLA published (0). Image generation and, since 24 April 2026, Upscale are GA (10).

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Adobe Firefly API 78

OpenAPI 3.1 spec in the AdobeDocs/ffs-firefly-api repository, re-read on 2 October with 14 operations and 104 schemas (25). No llms.txt (0). Endpoint guides state what each endpoint is for, little on when not to use one (13). Typed inputs with 41 enums and required fields, with the model picked by an x-model-version header (13). 71 examples, and every operation lists its 4xx and 5xx responses, with example bodies for 422 validation and 451 content-policy errors (12). Dated changelog that flags breaking changes (15).

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

Adobe Firefly API 63

OAuth server-to-server credentials from the Adobe Developer Console, exchanged at Adobe IMS for 24-hour bearer tokens, so no long-lived secret travels with each call (30). Credentials sit in a Developer Console project tied to the organisation's product profile (10). Returns generated images only (10). No per-call audit log found (0). Security programme (13): security.txt valid per the provenance check (5), a public bug bounty on Intigriti that names Adobe Firefly in scope, though not the API host (5), and public security bulletins at helpx.adobe.com/security (3). Adobe's compliance overview pairs no certification with Firefly, and the compliance list is a JavaScript table our reader couldn't load on 1 or 2 October, so no certification is counted (0).

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.

Adobe Firefly API 0

No x402, MPP or L402 (0). No public price list, access through an enterprise contract with Adobe sales (0). No free tier (0). A person has to negotiate a contract before any key exists (0).

SurgePix API 20

No x402, MPP or L402 (0). Plan prices and monthly credits are public, but credits are spent per token with no per-call price for any API task, so plan-only pricing (10). A free plan with 25 credits a day. The pages don't say whether a card is needed or whether a free account can create API keys, so half, a judgement call (10). A person signs up in a browser and creates the key in settings (0). 0+10+10+0 = 20.