Cohere Chat API (Command models) vs xAI API (Grok)

Cohere Chat API (Command models) 55

Model reading. Bearer keys of two kinds, trial and production. Team roles are Owner and User, only Owners delete production keys, and a production key is shown in full once. No scopes, expiry or per-model restriction was found (18 of 30). Paying customers can switch training off under Data Controls, which implies it is on until they do, trial keys fall under the website terms, and the SaaS agreement grants an irrevocable right to use API data to improve the services and share it with third parties (8 of 20). Logged prompts and generations are deleted after 30 days unless flagged, and zero data retention needs approval (12 of 15). The dashboard shows usage history, and no customer audit log was found (2 of 15). The trust centre lists SOC 2 Type II, ISO 27001, ISO 42001, UK Cyber Essentials, penetration tests on request and a responsible disclosure policy with a bug bounty, per the 9 October check. cohere.com/.well-known/security.txt still answers 404 on 2 November and no public advisories were found, so the line takes 15, as cohere-embed and cohere-north read the same programme (15 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Cohere Chat API (Command models) 72

Model reading. Function calling with tool_choice REQUIRED or NONE and strict_tools, which the reference marks beta (17 of 20). response_format takes json_object or a JSON Schema, with limits documented and no support in RAG mode (13 of 15). The usage object reports cached_tokens, and no guide or price for prompt caching was found (5 of 15). Context is 256,000 tokens on Command A and Command A Reasoning and 128,000 on Command A+ (10 of 15). /v2/batches runs a batch from an uploaded dataset, with no price or discount found (6 of 10). Official SDKs for Python, TypeScript, Java and Go (10). Error messages are specific and readable, with no stable error codes (11 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

Cohere Chat API (Command models) 35

No x402, MPP or L402 in the docs, the OpenAPI file or the pricing page (0). The docs say Command models are billed per input and output token. The pricing page, read on 2 November 2026, now carries per-unit prices in its own page data, Command R at $0.15 input and $0.60 output and Command R7B at $0.0375 and $0.15 per million tokens, with Command R+ 08-2024 at $2.50 and $10.00 among legacy prices and Command A+ shown as free. No price is published for Command A, Reasoning, Vision or Translate, so the line takes 15 rather than the full 20 (15 of 20). A trial key is created at sign-up and is free with no card (20). Sign-up is in a browser, and a production key needs an Owner to complete a Go to Production form (0).

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Cohere Chat API (Command models) 67

Hosted lines. status.cohere.com (incident.io) lists each Command model and the endpoints as components (20). Its feed, read on 2 November 2026, shows two incidents in the 90 days from 4 August. 'Multiple Endpoint Disruptions' on 1 September 2026, from 15:41 to 19:47 UTC, degraded the embeddings endpoint, embed-v4.0, two rerank models and command-a-reasoning-08-2025 during a Google Cloud outage, rated minor and partial, and docs loading failed on 5 August. Nothing has been posted since 1 September, so minor incidents only (20). Chat limits are published per model, 20 requests a minute and 1,000 calls a month on a trial key and 500 a minute on a production key for Command A, R, R+ and R7B, while the four newest variants say contact sales (12 of 15). The errors page documents 429 with example messages that say to wait and try again later and links to the rate limits, with no Retry-After header, backoff timing or idempotency key, the reading cohere-embed takes of the same page (8 of 15). cohere.com/slo is titled Service Level Objective and its text is script-drawn, so it was unread and scores as absent (0). The v2 chat endpoint is the default docs version, but the sample response on the chat guide still carries is_experimental and the newest models are not open to production keys (7 of 10).

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Cohere Chat API (Command models) 75

Closed service under a published SaaS agreement, MIT SDKs, and the docs say Command A+ weights are on Hugging Face under Apache 2.0, which we did not open (15 of 30). The Enterprise Data Commitments (5 December 2025) and the privacy policy (1 May 2026) agree on 30-day retention and a training opt-out. The SaaS agreement (8 April 2025) does not mention the opt-out and grants an irrevocable right to use and share API data, and the DPA is sent on request (16 of 30). Deprecations page with dated history back to 2024 and lifecycle terms, no minimum notice, and nothing newer than 4 April 2026 on 2 November, read at 15 as cohere-embed reads the same page (15 of 20). The trust centre names nine sub-processors with a location for each, all in the US, and Google Cloud US-Central as the data location, read at 20 as cohere-embed reads the same list (20 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Cohere Chat API (Command models) 72

Model reading. The last dated release on the Chat endpoint is still North Small Translate on 9 September 2026, 54 days before this check. The last Command model is Command A+ on 20 May 2026. Rerank 5 (21 October) and Embed 5 (30 September) aren't chat changes, so we score the 90-day band (20 of 30). The deprecations page defines Active, Legacy, Deprecated and Shutdown and promises email notice, with no minimum notice period (6 of 12). No chat model was retired or announced for retirement in the last 90 days. The newest entry on the page is still two Aya models retired on 4 April 2026 (8 of 8). Dated changelog with four entries since 4 August (27 August, 9 September, 30 September, 21 October), one of them for a chat model (12 of 15). SDK issue replies not sampled (5 of 10). Python SDK 7.2.0 and 7.3.0, TypeScript 8.2.0 (19 October) and 8.3.0, and Go v2.20.0 tagged on 21 October 2026, Java at 1.12.0 (15). The Python SDK is generated from the OpenAPI file and has a CI workflow, whose runs we did not read (6 of 10).

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).