Fireworks AI Inference vs xAI API (Grok)

Fireworks AI Inference 77

Read by the HTTP API checklist, as for cerebras-inference and together-inference. Service accounts with API keys issued on their behalf, roles assigned at creation and changeable (30). An inference-user role can call models but not create or modify resources (20). No inference prompt-injection mitigation established (0). Enterprise audit logs with a REST API, and cost exports per API key (15). The data-security page states SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, HIPAA support and regular penetration testing, with reports in a Vanta trust centre that renders only with JavaScript. fireworks.ai/.well-known/security.txt answered 404 on 1 November, as on 19 October, and no disclosure policy or bug bounty was found. That matches people-data-labs (12) and launchdarkly (12), which state SOC 2 Type II and ISO 27001 with no security.txt, disclosure policy or bounty, so the 20 the 19 October check gave is corrected (12). The terms (section 3.6) rule out training on customer content and inference has zero retention by default, recorded for reviewers and not scored on this checklist. 30+20+0+15+12 = 77.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Fireworks AI Inference 40

No machine payment protocol in the docs index or billing pages, re-read on 1 November (0). Public per-token prices by model and serving mode (20). The credits FAQ documents a $1 starter credit that runs without a payment method, after which the account is suspended until one is added (20). Account signup and credit purchases need a person (0).

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Fireworks AI Inference 70

Public status page at status.fireworks.ai with a component per serverless model (20). The history page, read on 1 November, lists 236 incidents from 3 August to 31 October, nearly all short degradations of a single serverless model. Two hit many serverless models at once. On 11 August a cloud provider outage was 'affecting many of our serverless and dedicated deployments', with five serverless components (GPT OSS 120B, MiniMax M3 and the three Kimi K3 endpoints) in partial outage from 17:15 to 20:55 UTC and again from 01:36 to 01:49 UTC on 12 August, resolved 13 August. On 14 October a cloud provider outage set 18 serverless components to degraded performance, GPT OSS 120B, Kimi K3 and GLM 5.3 among them, from 23:06 UTC, with requests to them that 'may fail', recovery 'across the board' at 00:59 UTC on 15 October and the incident resolved at 01:53. Each is an hour or more of errors across most of the serverless catalogue, so two majors. Two majors sit between the checklist's one major (10) and several (0), so 5, as deepseek-api, black-forest-labs and telnyx-voice are read (5). The 19 October check gave the same 5 because no 90-day history could be read. A 30 October incident on deployment creation, dedicated training and batch inference was still open on 1 November. Numeric adaptive ceilings by model size, 216M total prompt, 54M uncached prompt and 2.16M generated tokens a minute for Small models (15). The rate-limits page says to honour Retry-After on 429 and otherwise back off with jitter, and the reliability guide covers timeouts and retries (15). Reserved throughput is 'covered by a throughput SLA' with no figure published (5 of 10). Serverless is generally available (10). 20+5+15+15+5+10 = 70.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Fireworks AI Inference 65

Read by the HTTP API checklist, as for cerebras-inference and together-inference. Rune 26B-A4B joined serverless on 27 October, five days before this check (30). Dated changelog entries several times a month, among them 27, 21, 19 and 18 October (20). Support replies not tested (0). Official Python SDK current, v1.2.30 tagged on 21 October after eleven tags from 1 October, no official TypeScript SDK (15). Dependency health not audited (0). The serverless overview promises 'at least 2 weeks advance notice' before a model is removed, and the 27 August removals were posted the day they took effect (see the deduction). 30+20+0+15+0 = 65.

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).

Fireworks AI Inference 80

Read by the HTTP API checklist, as for cerebras-inference and together-inference. Compact model API with bounded output, max_tokens and streaming (25). Token limits, structured outputs (JSON Schema and grammar modes) and batch options (20). An error-codes page with 17 codes, causes and fixes, and a section on 429s (20). Retry guidance without a general deduplication guarantee (5 of 20). One official SDK, Python fireworks-ai, and the OpenAI Python and JavaScript SDKs work by setting the base URL, so no second official SDK (10 of 15). Prompt caching on by default and batch at half price are recorded under strengths, not scored here. 25+20+20+5+10 = 80.

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

Fireworks AI Inference 69

Proprietary service, Apache-2.0 Python SDK. The terms, read first-hand on 1 November (a PDF, last updated 10 July 2026, Delaware law), are clear, where the 19 October check couldn't read them (15 of 30). The data-handling page and section 3.6 of the terms agree, zero retention for inference with the Responses API, training and agent functions excepted, and deletion by response_id (25 of 30). Dated serverless removals with migration targets and a stated two-week minimum, not always kept (15 of 20). Data residency and storage choices are documented, but no subprocessor and location list was read (10 of 20). 15+25+15+10 = 65.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).