Black Forest Labs FLUX API vs SurgePix API

Black Forest Labs FLUX API 80

Atlassian Statuspage at status.bfl.ai (redirects to status.bfl.ml) with a component per model family and per regional endpoint (20). The 90 days from 4 August to 2 November, read from history.atom on 2 November, hold incidents that each name one model, one region or one cluster. On 19 August one inferencing cluster was down for about 7.7 hours (11:15 to 18:57 UTC), "impacting FLUX.2 [flex] traffic. The rest of our models should be unimpacted". From 19 August 19:47 to 20 August 00:39 UTC an EU cluster outage slowed or failed generations on api.eu.bfl.ai while traffic on api.bfl.ai was shifted to other clusters. Also partial were FLUX 3 Video launch load (4 and 5 August), US latency on 13 August, extended flux-3-video times on 19 August, US latency on 8 September (about 6.5 hours) and EU latency on 29 and 30 September (about 20 hours). Since 1 October the page shows only maintenance windows. This run reads an incident limited to one product, one region or one cluster as partial and minor whatever its length, so the 17 October reading of the two August incidents as majors (5) is brought into line, minor incidents only (20). 24 concurrent requests on most endpoints, 6 on flux-kontext-max (15). Backoff on 429 documented with example code (15). An SLA is mentioned for enterprise contracts with no figure published (0). FLUX.2 is GA (10). 20+20+15+15+0+10 = 80.

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Black Forest Labs FLUX API 88

OpenAPI specs at api.bfl.ai/openapi.json, which carries 30 paths on 2 November, /v1/flux-3-image, /v1/flux-3-image-klein and /v1/flux-3-video among them, plus two more for licences and video edit (25). llms.txt with about 120 links, every page also served as Markdown (10). Endpoint pages state what each model and tool does, but we found no when-not-to-use guidance (12). Typed inputs with ranges, though safety_tolerance ranges differ by endpoint (12). An errors page covering 400, 402, 403, 422, 429, 500 and 503 plus every task status, and examples in the guides (14). Versioned path and a dated release notes page (15).

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

Black Forest Labs FLUX API 65

Closed API with clear developer terms that give you the output (15). The privacy policy (1 August 2026) says prompts and uploads may be used for training unless you email an opt-out, while the enterprise page promises zero data retention on the managed API. No retention periods stated (10). Dated deprecation notices in the release notes, such as FLUX Pro 1.0 and the Finetuning API announced on 3 October 2025 for 31 October 2025, but no written policy, and the developer terms (4 August 2026) allow changing or removing parts of the service without notice (10). EU and US regional endpoints and named controllers per region, but no subprocessor list (10).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Black Forest Labs FLUX API 60

Model reading of the checklist (credential, training, retention, operator visibility, programme). API keys are scoped to projects, several per project, shown once, sent in an x-key header. The MCP server uses OAuth with organisation selection. No permission scopes on keys (25 of 30). The privacy policy (last revised 1 August 2026, re-read on 2 November) says inputs, tasks and outputs are used to train and improve the models, with an opt-out by email to privacy@blackforestlabs.ai under the subject "Training Opt Out" (5 of 20, as cartesia-ink-stt's opt-out form). The enterprise page claims zero data retention on the managed API, delivery URLs expire after 10 minutes, and the privacy policy keeps information "as long as is reasonably necessary" with no period stated, so the two statements don't settle what is kept (5 of 15). Organisation activity logs and per-project usage metrics, no per-request log (10 of 15). security.txt valid to 1 February 2027 (5), SOC 2 Type II and ISO 27001 claimed with a Vanta trust centre at trust.bfl.ai (10), no bug bounty found (0), 15 of 20. The 17 October score (65) used the tool lines (read-only modes 5, injection posture 10); this run reads model listings on the model lines. 25+5+5+10+15 = 60.

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.

Black Forest Labs FLUX API 67

Responses carry a short-lived URL, not image bytes, and the MCP server has 7 tools (22). Width, height and output format controls, history pagination in MCP (15). Status codes and task statuses an agent can act on, with moderation reasons added in June 2026 (17). No idempotency key, so a resubmitted job is a new paid job, and the MCP docs don't mention readOnlyHint or destructiveHint (5). Only prompt required on generation, but no official SDK package (8).

SurgePix API 53

Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. noWait chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON code and msg, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero code and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (fileUrl for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.

Black Forest Labs FLUX API 73

Model reading (notice and churn in place of release counts). The last release note is dated 22 October 2026 (FLUX 3 Image custom output sizes and match_input), after FLUX 3 Image Klein on 15 October and FLUX 3 Image on 1 October, ten dated notes from 4 August to 22 October (30). FLUX.1 models stayed on sale after FLUX.2 and FLUX 3 shipped, and no model was retired in the 90 days to 2 November. FLUX Pro 1.0 and the Finetuning API were retired on 31 October 2025 after 28 days' notice, the Finetuning API with no migration path. There's no notice policy and the terms allow changing or removing parts of the service without notice (15). Public release notes, support channel not tested (8). Official MCP server in the registry as io.github.black-forest-labs/flux-mcp 1.0.0, published 26 May 2026 (15). No SDK packages to assess (5). 30+15+8+15+5 = 73.

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.