Bria API vs SurgePix API

Bria API 83

Read with the hosted lines. Atlassian Statuspage at status.bria.ai with API components and history (20). history.atom, read on 2 November, has one incident from 4 August to 2 November 2026, "API Outage for Image Editing, Increase Resolution and Image generation" on 22 September, resolved in 18 minutes with no cause given. The incident page lists two affected components, Image Generation (API) and Image Editing (API), and not the Tailored Generation, Product Shot, Ad Generation, Video Editing or AI Search APIs, so it reads as partial and minor (20). The 8 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so that source is struck; the feed gives the same record. Limits published per plan, 10, 60 and 1,000 requests a minute per endpoint (15). The docs tell callers to back off with jitter and honour Retry-After on 429, and the SDKs retry status polls only so a job is not started twice. No idempotency key (13). The site states a 99.9 per cent uptime SLA for managed cloud, but no SLA document was found and the online terms supply the products as is, so half credit (5), per the 8 October check, not re-read on 2 November. The REST API is generally available (10). 20+20+15+13+5+10 = 83.

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Bria API 84

A downloadable OpenAPI 3.0 file for each API, such as /_bundle/image-generation.yaml (25). llms.txt, a Markdown twin of every page and a docs MCP server at docs.bria.ai/mcp (10). Endpoint pages state the purpose and the valid input combinations, and the MCP tool descriptions say when to use edit_image in place of text_to_image (17). Enums for resolution, aspect ratio and output type, but structured_prompt is a JSON document passed as a string (12). Request and response examples, an error table and typed error bodies per endpoint, with error.code shown only as a placeholder (13). Paths are versioned v1 and v2, but the OpenAPI files have an empty version and no API changelog was found (7).

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

Bria API 52

Closed hosted API under the Online AI General Terms and Conditions, a PDF linked from the website terms (read on 8 October as the March 2025 version, V1.1; the linked file is titled August 2025, v1.2 on 2 November). SDKs and the MCP server are MIT. Model weights are source-available for non-commercial use (15). The terms warrant no training on customer content without written consent and deletion within 30 days of termination. The docs give 3 days for image results and say inputs are not kept beyond processing. The privacy policy has no date and no retention periods, and does not name Google, whose Gemini 2.5 Flash handles prompts on the standard generate endpoint (20). No deprecation policy. One endpoint is marked deprecated without a date (3). The privacy policy lists recipient categories only, with vendor names on request by email. Data locations not stated (4).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Bria API 76

Results come back as URLs, with a seed and the full structured prompt. The MCP server has 18 tools and returns a JPEG preview of up to 0.7 MB inline (18). Resolution, aspect ratio, output type and a sync or async choice, with nothing to paginate (15). One error shape with request_id, a status table and messages the MCP server passes through as Bria API error <status code>: <reason> (18). No idempotency key. Webhooks carry Bria-Webhook-Id for deduplication. The MCP tools carry annotations, but all 18 are marked read-only and idempotent although each call is billed (10). Only a prompt is required, and there are official Python and TypeScript SDKs (15).

SurgePix API 53

Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. noWait chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON code and msg, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero code and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (fileUrl for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.

Bria API 40

No x402, MPP or L402 (0). Per-image, per-call and per-second prices published without a login, from $0.018 to $0.05 an image on 2 November (20). 100 free generations with no card (20). A person has to sign up in the console to get a key. The MCP OAuth flow has dynamic client registration but still needs a Bria account sign-in (0). 0+20+20+0 = 40.

SurgePix API 20

No x402, MPP or L402 (0). Plan prices and monthly credits are public, but credits are spent per token with no per-call price for any API task, so plan-only pricing (10). A free plan with 25 credits a day. The pages don't say whether a card is needed or whether a free account can create API keys, so half, a judgement call (10). A person signs up in a browser and creates the key in settings (0). 0+10+10+0 = 20.

Bria API 53

Model reading of the checklist (credential, training, retention, operator visibility, programme). Several named, revocable organisation keys with no scopes, plus OAuth 2.1 with PKCE on the hosted MCP server, where the scopes are identity only (20). Less 10 because the streaming background removal WebSocket takes api_token (or an OAuth token) as a URL query parameter, re-read on 2 November (10 of 30). The Online AI General Terms and Conditions warrant no training on customer content without written consent, per the 8 October check, not re-read on 2 November. The website terms of use, re-read on 2 November, limit the licence Bria takes in customer data to providing the Services (20 of 20). The asset retention page (re-read 2 November) says inputs are not retained beyond processing, image results expire after 3 days by default and can be changed per organisation, video results don't expire by default and legacy /v1/product/* results last 1 hour. The privacy policy states no periods (10 of 15). Each response has a request_id. Audit logs are listed for Enterprise only (5 of 15). The site states ISO 27001 certification and SOC 2 attestation with no report, auditor or trust centre linked. No security.txt (404 on 2 November), disclosure policy or bug bounty found (8 of 20). The 8 October score (33) used the tool lines (read-only modes 0, injection posture 10); this run reads model listings on the model lines. 10+20+10+5+8 = 53.

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.