Black Forest Labs FLUX API vs FLORA

Black Forest Labs FLUX API 80

Atlassian Statuspage at status.bfl.ai (redirects to status.bfl.ml) with a component per model family and per regional endpoint (20). The 90 days from 4 August to 2 November, read from history.atom on 2 November, hold incidents that each name one model, one region or one cluster. On 19 August one inferencing cluster was down for about 7.7 hours (11:15 to 18:57 UTC), "impacting FLUX.2 [flex] traffic. The rest of our models should be unimpacted". From 19 August 19:47 to 20 August 00:39 UTC an EU cluster outage slowed or failed generations on api.eu.bfl.ai while traffic on api.bfl.ai was shifted to other clusters. Also partial were FLUX 3 Video launch load (4 and 5 August), US latency on 13 August, extended flux-3-video times on 19 August, US latency on 8 September (about 6.5 hours) and EU latency on 29 and 30 September (about 20 hours). Since 1 October the page shows only maintenance windows. This run reads an incident limited to one product, one region or one cluster as partial and minor whatever its length, so the 17 October reading of the two August incidents as majors (5) is brought into line, minor incidents only (20). 24 concurrent requests on most endpoints, 6 on flux-kontext-max (15). Backoff on 429 documented with example code (15). An SLA is mentioned for enterprise contracts with no figure published (0). FLUX.2 is GA (10). 20+20+15+15+0+10 = 80.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

Black Forest Labs FLUX API 30

No x402, MPP or L402 (0). Per-image and per-megapixel prices published without a login on bfl.ai/pricing and in the release notes, from $0.008 for FLUX 3 Image Klein at 768 by 768 (20). No free credits documented (0). Browser sign-up and prepaid credit (0). 0+20+0+0 = 20. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Black Forest Labs FLUX API 73

Model reading (notice and churn in place of release counts). The last release note is dated 22 October 2026 (FLUX 3 Image custom output sizes and match_input), after FLUX 3 Image Klein on 15 October and FLUX 3 Image on 1 October, ten dated notes from 4 August to 22 October (30). FLUX.1 models stayed on sale after FLUX.2 and FLUX 3 shipped, and no model was retired in the 90 days to 2 November. FLUX Pro 1.0 and the Finetuning API were retired on 31 October 2025 after 28 days' notice, the Finetuning API with no migration path. There's no notice policy and the terms allow changing or removing parts of the service without notice (15). Public release notes, support channel not tested (8). Official MCP server in the registry as io.github.black-forest-labs/flux-mcp 1.0.0, published 26 May 2026 (15). No SDK packages to assess (5). 30+15+8+15+5 = 73.

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Black Forest Labs FLUX API 88

OpenAPI specs at api.bfl.ai/openapi.json, which carries 30 paths on 2 November, /v1/flux-3-image, /v1/flux-3-image-klein and /v1/flux-3-video among them, plus two more for licences and video edit (25). llms.txt with about 120 links, every page also served as Markdown (10). Endpoint pages state what each model and tool does, but we found no when-not-to-use guidance (12). Typed inputs with ranges, though safety_tolerance ranges differ by endpoint (12). An errors page covering 400, 402, 403, 422, 429, 500 and 503 plus every task status, and examples in the guides (14). Versioned path and a dated release notes page (15).

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

Black Forest Labs FLUX API 60

Model reading of the checklist (credential, training, retention, operator visibility, programme). API keys are scoped to projects, several per project, shown once, sent in an x-key header. The MCP server uses OAuth with organisation selection. No permission scopes on keys (25 of 30). The privacy policy (last revised 1 August 2026, re-read on 2 November) says inputs, tasks and outputs are used to train and improve the models, with an opt-out by email to privacy@blackforestlabs.ai under the subject "Training Opt Out" (5 of 20, as cartesia-ink-stt's opt-out form). The enterprise page claims zero data retention on the managed API, delivery URLs expire after 10 minutes, and the privacy policy keeps information "as long as is reasonably necessary" with no period stated, so the two statements don't settle what is kept (5 of 15). Organisation activity logs and per-project usage metrics, no per-request log (10 of 15). security.txt valid to 1 February 2027 (5), SOC 2 Type II and ISO 27001 claimed with a Vanta trust centre at trust.bfl.ai (10), no bug bounty found (0), 15 of 20. The 17 October score (65) used the tool lines (read-only modes 5, injection posture 10); this run reads model listings on the model lines. 25+5+5+10+15 = 60.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.