FLORA vs Ideogram API

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Ideogram API 38

Ideogram 4.5 is in API v2 and was the subject of Ideogram's blog post of 14 October 2026, 10 days ago, and Ideogram Vector 1.0 is in the API on 24 October, so the last change is within 30 days (30, from 10). For models we look at churn and notice. API v2 arrived with v1 left running and a v1 to v2 table, and Ideogram 3.0 stays on for inpainting and reframe, but there's no notice policy or dated deprecation (5). No public changelog, support channel not tested (3). No official SDK (PyPI's ideogram belongs to an unrelated project) (0). No packages to assess (0). Per the 24 October check, not re-read on 4 November (ideogram.ai is paused on its terms). The 14 October post is 21 days old on 4 November.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

Ideogram API 43

Plain API keys, shown once, revocable, each with full access to the account, no scopes. The hosted MCP server uses OAuth with an Ideogram account (20). The $300 balance cap limits what a leaked key can spend, no read-only mode (5). Returns generated images, SVGs, video and image descriptions only (10). GET /v2/account/usage reports billed usage by product, API key and time bucket, and GET /v2/account/api-keys lists keys, but there is no per-call log (8, from 0). No security.txt (ideogram.ai/.well-known/security.txt returns the web app, api.ideogram.ai returns 404), no bug bounty and no SOC 2 or ISO 27001 statement found (0). Per the 24 October check, not re-read on 4 November, because Ideogram's terms of service bar automated access to ideogram.ai.

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Ideogram API 30

No x402, MPP or L402 (0). Per-image and per-SVG prices published without a login on the Ideogram Vector and Ideogram 4.5 model pages; the API pricing page still loads its table with JavaScript (20). No free tier. Requests return 402 until the account has a payment method and credit (0). Browser sign-up (0). Per the 24 October check, not re-read on 4 November, because Ideogram's terms of service bar automated access to ideogram.ai. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

Ideogram API 49

Closed API under a Developer API Agreement last revised on 14 August 2024, unchanged on 24 October. Ideogram 4.0 weights are public under a non-commercial licence, which doesn't change the API terms (15). The agreement says Ideogram won't train on API inputs or outputs unless they're flagged under the usage policies, but states no retention period, and clause 4.3 also gives Ideogram the right to use 'in any manner all User data received by the Company via the Ideogram API'. Kept at 12 as on 1 October; a reviewer may read 4.3 as a disagreement and score lower (12). The agreement promises commercially reasonable efforts to give prior notice of changes that need developer work and makes fee changes effective 14 days after posting, and we found no dated deprecation notices (5). No subprocessor list or data locations found; the privacy policy was last revised on 15 January 2025 (0). The Developer API Agreement was re-read on 4 November and still carries the 14 August 2024 revision, the no-training clause and clause 4.3. The privacy policy is per the 24 October check.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

Ideogram API 55

Atlassian Statuspage at status.ideogram.ai with API and Web App components, per the 24 October check (20). status.ideogram.ai is an ideogram.ai host, whose terms of service bar automated access, so it wasn't re-read on 4 November. The same page also answers at ideogram.statuspage.io, but that copy names status.ideogram.ai as its canonical address and Ideogram's own API Status link points to status.ideogram.ai, so it wasn't used, and 25 October to 4 November is unread. In the part of the 90 days from 6 August read on 24 October there are eight API incidents (nine posts), two of them majors by this run's reading. /generate and /remix were down from 10:38 to 13:21 UTC on 21 October (posted twice), about 2 hours 40 minutes, and all models were out on the API and web app on 2 October (identified 13:14, resolved 13:36 UTC), a full outage of the listed API however short, which the 24 October check had read as minor. The others were partial, Reframe v3 for 23 minutes on 29 August, v3 for 43, 17, 18 and 10 minutes on 4, 23, 24 and 29 September and /generate and /remix for 21 minutes on 20 October. The unread days earn no credit (two majors, 5, from 10). 10 in-flight requests by default per the API overview, per the 24 October check, not re-read on 4 November (15). The v2 reference documents 429 with a reject_reason (such as inflight_limit with max_inflight_requests) and a Retry-After header on polling, but no back-off guidance for generation calls and no idempotency key, per the 24 October check, not re-read on 4 November (5, the earlier partial kept). No SLA (0). Ideogram Vector and the v2 endpoints carry no beta or preview label, per the 24 October check, not re-read on 4 November (10). Total 55.