DeepSeek API vs xAI API (Grok)

DeepSeek API 35

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading. One Bearer key per balance, no scoping found (20 of 30). The privacy policy, last updated 10 February 2026, says personal data is used to train models, with an opt-out by email to privacy@deepseek.com (0 of 20). Data kept for as long as needed to provide the services, with no period stated and no zero-retention route (5 of 15). Per-call logs or audit logs not found (5 of 15). Security programme 5 of 20 (was 0). The www.deepseek.com footer carries a Report Security Issue address, security@deepseek.com, per the 21 October reading used for DeepSeek's open-weight listings and its Search and Fetch API listing. No security.txt (404 on 17 October), disclosure policy, certification or bug bounty found. 20 + 0 + 5 + 5 + 5 = 35.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

DeepSeek API 49

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). No OpenAPI document and no llms.txt found (0 and 0). API reference covers both the OpenAI and Anthropic formats. The chat completion reference, read on 2 October, describes each parameter with its range and default, such as max_tokens from 1 to 393,216 with 8K by default without thinking, but says little on when not to use one (14 of 20). Strict tool calls are documented, in beta at the /beta base URL, with a JSON Schema subset (object, string, number, integer, boolean, array, enum, anyOf, $ref) where every property must be required. JSON output mode carries no schema guarantee (10 of 15). The error codes page lists seven codes, each with a cause and a fix, but no example bodies (10 of 15). Dated updates page that names model changes (15). 0 + 0 + 14 + 10 + 10 + 15 = 49.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

DeepSeek API 46

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading. V4.1 Flash was upgraded to DeepSeek-V4.1-Flash-1017 on 17 October under the same deepseek-flash name and price, posted on the updates page the same day, 19 days before this check (30). Later updates entries are unread. No stated notice policy. deepseek-chat and deepseek-reasoner got three months, announced on 24 April for 24 July. One dated notice with no stated period partly meets the line, and the earlier partial award is held (4 of 12). Model churn covers the V4 Flash retirement on 10 September and the V4 Pro shutdown set for 14 September, announced on 13 August and withdrawn on 10 September. The 24 July shutdown has left the 90-day window. A retirement and a withdrawn shutdown inside it keep churn at the bottom of its range (0 of 8). Dated updates page, and the docs list api-service@deepseek.com and a Discord server for support. We didn't test whether either answers (12 of 15). No official SDKs or SDK repository (0 of 15, 0 of 10). 30 + 4 + 0 + 12 + 0 + 0 = 46.

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).

DeepSeek API 70

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calls through both request formats, and the API reference documents tool_choice as none, auto, required or a named function (20 of 20). Strict schema-enforced tool calls in beta, JSON output without a schema guarantee (10 of 15). Disk cache on by default with cheaper hits, per the listing (15). 1M-token context and up to 384K output (15). No batch API documented (0). No official SDKs, you use the OpenAI or Anthropic client (0). Seven error codes with a fix for each, 402 for an empty balance (10 of 15). 20 + 10 + 15 + 15 + 0 + 0 + 10 = 70.

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

DeepSeek API 60

Per the 17 October check, not re-read on 5 November (DeepSeek's terms bar automated access, so nothing on DeepSeek's hosts was requested). Status page at status.deepseek.com, run on Flashduty, with per-API components and a readable feed (20). The recorded feed lists 36 incidents from 22 July to 15 October. Four touch only web search, 27 are degraded performance, and five are partial unavailability, one of them (12 October) the web chat only. Of the four that hit the API, 28 July (7 minutes) has left the 90-day window and 2 September lasted 31 minutes. 14 September (18:30 to 21:30 UTC) left the V4.1 Flash API and chat partly unavailable for three hours, and 15 October (00:11 to 05:04 UTC) left the V4 Pro and V4.1 Flash APIs and chat partly unavailable for 4 hours 52 minutes. Two majors in 90 days sit between one (10) and several (0), so 5. 16 October to 5 November is unread and earns nothing beyond the recorded award (5). Concurrency caps published per account, 2,500 on Flash and 500 on V4 Pro, and requests that haven't started inference after 10 minutes are closed (15). The rate-limit and error pages document 429, and advise a brief wait and retry on 500 and 503, with no Retry-After header, backoff schedule or statement that a retried call is safe (10 of 15). No SLA found (0). V4 Pro and V4.1 Flash are GA (10). 20 + 5 + 15 + 10 + 0 + 10 = 60.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).