# Bria API vs SurgePix API (slim)

> Bria scores 67.5 (B) to SurgePix's 36 (F) for image generation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bria-vs-surgepix.md (~5,200 tokens) · this version ~3,330 tokens · JSON https://www.anchorterminal.com/compare/bria-vs-surgepix.json · canonical https://www.anchorterminal.com/compare/bria-vs-surgepix
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-02
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Bria API scores 67.5 (B) on agent readiness against SurgePix API's 36 (F), and leads in every scored category. Both do image generation.

- Bria API: B 67.5, rank #275 of 1266 · https://www.anchorterminal.com/tools/bria.min.md
- SurgePix API: F 36, rank #1173 of 1266 · https://www.anchorterminal.com/tools/surgepix.min.md
- Bria API, good for Teams that need image generation and editing with a stated training-data licence, C2PA marking and an indemnity (capped on Pay-as-you-go, unlimited on Enterprise), and product-shot or background work at volume. Ahead on Reliability, 83 against 15; Schema & documentation, 84 against 40; Agent ergonomics, 76 against 53; Security & auth, 53 against 41; Payments & pricing, 40 against 20; Transparency & trust, 52 against 28. Also Runs on your own machine.
- SurgePix API, good for An agent that needs finished marketing assets, such as posters, slide decks, Xiaohongshu carousels, logos and translated images, as one file from a short request.

| Category | Bria API | SurgePix API |
| --- | --- | --- |
| Reliability (16%) | 83 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 40 |
| Agent ergonomics (13%) | 76 | 53 |
| Security & auth (14%) | 53 | 41 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 69 | 66 |
| Transparency & trust (7%) | 52 | 28 |

| Fact (where they differ) | Bria API | SurgePix API |
| --- | --- | --- |
| Kind | Model API | HTTP API |
| Vendor | Bria AI | SurgePix |
| Hosted endpoint | `https://engine.prod.bria-api.com/v2` | `https://api.surgepix.ai/api` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | API key |
| Licence | none | Proprietary hosted service under the Surgepix User Agreement, which names no company and restricts commercial use without SurgePix's permission. The agent skills repository is MIT |
| Tools exposed | 18 | none |
| llms.txt | yes | no |
| MCP registry | `com.bria-api/bria-mcp` | not listed |
| Last release | 2026-10-25 | 2026-10-23 |
| Terms last updated | couldn't be read | no date given |
| Privacy policy last updated | no date given | 2026-06-10 |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | yes |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Popularity | 341 npm/wk, 3.9k PyPI/wk | none |
| Agent reviews | 3.5/5 (4) | none |

Why the edge:
- Reliability, Bria API +68: Bria API 83 (Read with the hosted lines. Atlassian Statuspage at status.bria.ai with API components and history (20). history.atom, read on 2 November, has one incident from 4 August to 2 November 2026, "API Outage for Image Editing, Increase Resolution and Image generation" on 22 September, resolved in 18 minutes with no cause given. The incident page lists two affected components, Image Generation (API) and Image Editing (API), and not the Tailored Generation, Product Shot, Ad Generation, Video Editing or AI Search APIs, so it reads as partial and minor (20). The 8 October reading came from the page's /api/v2/incidents.json, which the host's robots.txt disallows, so that source is struck; the feed gives the same record. Limits published per plan, 10, 60 and 1,000 requests a minute per endpoint (15). The docs tell callers to back off with jitter and honour `Retry-After` on 429, and the SDKs retry status polls only so a job is not started twice. No idempotency key (13). The site states a 99.9 per cent uptime SLA for managed cloud, but no SLA document was found and the online terms supply the products as is, so half credit (5), per the 8 October check, not re-read on 2 November. The REST API is generally available (10). 20+20+15+13+5+10 = 83.); SurgePix API 15 (Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.)
- Schema & documentation, Bria API +44: Bria API 84 (A downloadable OpenAPI 3.0 file for each API, such as `/_bundle/image-generation.yaml` (25). `llms.txt`, a Markdown twin of every page and a docs MCP server at docs.bria.ai/mcp (10). Endpoint pages state the purpose and the valid input combinations, and the MCP tool descriptions say when to use `edit_image` in place of `text_to_image` (17). Enums for resolution, aspect ratio and output type, but `structured_prompt` is a JSON document passed as a string (12). Request and response examples, an error table and typed error bodies per endpoint, with `error.code` shown only as a placeholder (13). Paths are versioned v1 and v2, but the OpenAPI files have an empty version and no API changelog was found (7).); SurgePix API 40 (No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and `error.file.sensitive_content` (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.)
- Transparency & trust, Bria API +24: Bria API 52 (Closed hosted API under the Online AI General Terms and Conditions, a PDF linked from the website terms (read on 8 October as the March 2025 version, V1.1; the linked file is titled August 2025, v1.2 on 2 November). SDKs and the MCP server are MIT. Model weights are source-available for non-commercial use (15). The terms warrant no training on customer content without written consent and deletion within 30 days of termination. The docs give 3 days for image results and say inputs are not kept beyond processing. The privacy policy has no date and no retention periods, and does not name Google, whose Gemini 2.5 Flash handles prompts on the standard generate endpoint (20). No deprecation policy. One endpoint is marked deprecated without a date (3). The privacy policy lists recipient categories only, with vendor names on request by email. Data locations not stated (4).); SurgePix API 28 (The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.)
- Agent ergonomics, Bria API +23: Bria API 76 (Results come back as URLs, with a `seed` and the full structured prompt. The MCP server has 18 tools and returns a JPEG preview of up to 0.7 MB inline (18). Resolution, aspect ratio, output type and a sync or async choice, with nothing to paginate (15). One error shape with `request_id`, a status table and messages the MCP server passes through as `Bria API error <status code>: <reason>` (18). No idempotency key. Webhooks carry `Bria-Webhook-Id` for deduplication. The MCP tools carry annotations, but all 18 are marked read-only and idempotent although each call is billed (10). Only a prompt is required, and there are official Python and TypeScript SDKs (15).); SurgePix API 53 (Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. `noWait` chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON `code` and `msg`, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero `code` and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (`fileUrl` for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.)
- Payments & pricing, Bria API +20: Bria API 40 (No x402, MPP or L402 (0). Per-image, per-call and per-second prices published without a login, from $0.018 to $0.05 an image on 2 November (20). 100 free generations with no card (20). A person has to sign up in the console to get a key. The MCP OAuth flow has dynamic client registration but still needs a Bria account sign-in (0). 0+20+20+0 = 40.); SurgePix API 20 (No x402, MPP or L402 (0). Plan prices and monthly credits are public, but credits are spent per token with no per-call price for any API task, so plan-only pricing (10). A free plan with 25 credits a day. The pages don't say whether a card is needed or whether a free account can create API keys, so half, a judgement call (10). A person signs up in a browser and creates the key in settings (0). 0+10+10+0 = 20.)
- Security & auth, Bria API +12: Bria API 53 (Model reading of the checklist (credential, training, retention, operator visibility, programme). Several named, revocable organisation keys with no scopes, plus OAuth 2.1 with PKCE on the hosted MCP server, where the scopes are identity only (20). Less 10 because the streaming background removal WebSocket takes `api_token` (or an OAuth token) as a URL query parameter, re-read on 2 November (10 of 30). The Online AI General Terms and Conditions warrant no training on customer content without written consent, per the 8 October check, not re-read on 2 November. The website terms of use, re-read on 2 November, limit the licence Bria takes in customer data to providing the Services (20 of 20). The asset retention page (re-read 2 November) says inputs are not retained beyond processing, image results expire after 3 days by default and can be changed per organisation, video results don't expire by default and legacy `/v1/product/*` results last 1 hour. The privacy policy states no periods (10 of 15). Each response has a `request_id`. Audit logs are listed for Enterprise only (5 of 15). The site states ISO 27001 certification and SOC 2 attestation with no report, auditor or trust centre linked. No `security.txt` (404 on 2 November), disclosure policy or bug bounty found (8 of 20). The 8 October score (33) used the tool lines (read-only modes 0, injection posture 10); this run reads `model` listings on the model lines. 10+20+10+5+8 = 53.); SurgePix API 41 (Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the `authorization` header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.)