FLORA vs OpenAI Image API

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

OpenAI Image API 30

No x402, MPP or L402 (0). Per-token prices published without a login. No per-image figure for GPT Image 2.5, but the unit price is public (20). No free tier for image models. The rate-limits guide lists a Free tier, but the GPT Image 2.5 Flare page starts its limits at Build, which needs $5 of credit, read as the OpenAI speech-to-text listing reads the same pattern (0). Human sign-up and organisation verification before the first GPT Image call (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

OpenAI Image API 90

Closed models, clear Services Agreement that assigns output to the customer (15). The data controls page, re-read on 1 November, gives both image endpoints no training, 30-day abuse logs and no application state, and Zero Data Retention for the GPT Image models it names (gpt-image-2.5-sunburst, gpt-image-2.5-flare, gpt-image-2, gpt-image-1.5 and gpt-image-1-mini). Image inputs flagged by the CSAM scan are kept for review even under Zero Data Retention, and the guide says so. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 1 November (openai.com answered 403). The same reading as the OpenAI API listing (30 of 30, was 28 with no reason given). Deprecation policy with notice periods by model class and a dated table (20). The subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries for each and a form for notice of new ones, per the OpenAI API listing's 4 October check, not re-read on 1 November (openai.com answered 403), and the data-controls guide lists the image endpoints in every residency region for storage and the United States and Europe for processing (20). 15 + 30 + 20 + 20 = 85.

FLORA 46

Hosted reading, for the MCP server and the REST API. A status page at status.flora.ai is linked from the home page and the MCP page, but its robots.txt answered a client error twice on 2 November 2026, so under our rules nothing on that host was fetched and its components are unread (10 of 20, for a linked page whose content we could not check). No readable incident history, so the floor, and this is our fetch rule rather than a finding about FLORA (5). No requests-per-minute figure is published, as the cost and limits page says in so many words; batch sizes (1 to 20 generations, 20 run ids, 50 canvas nodes, 25 files), the polling cooldown (15 seconds, or 2 seconds a run) and one-at-a-time generation for new unpaid accounts are given with numbers (8 of 15). 429 rate_limited is documented with Retry-After on the API and retry_after_seconds on MCP, a 60-second fallback, exponential backoff and a retryability table, and the SDK retries 408, 429 and 5xx twice. Idempotency-Key covers every mutating REST request for two hours, but flora_create_generations over MCP has none and the docs say to read history before retrying (13 of 15). No SLA; the terms provide the service as is (0). No beta or preview label on either surface; the old beta endpoint was removed on 30 June 2026, though the registry version is 0.11.5 (10). 10+5+8+13+0+10 = 46.

OpenAI Image API 65

Public status page at status.openai.com with incidents filed per component (20). The feed and incident pages, read on 1 November, list the Images component in two API-wide error incidents in the 90 days from 3 August, elevated error rates across API models on 17 September (impact window 20:20 to 21:20 UTC on the incident page, updates to 21:50, 11 API components) and elevated errors across ChatGPT, Codex and the API on 29 September (17:52 to 23:14 UTC on the incident page, about 5 hours 20 minutes, 30 components). Each is an hour or more of wide errors, so two majors. The 1 October check counted only image-specific incidents and scored minor only. Two majors sit between the checklist's one major (10) and several (0), so 5, as the OpenAI Moderation listing reads the same two incidents and as deepseek-api, black-forest-labs, telnyx-voice and fireworks-inference are read (5). Image-specific incidents in the window are all partial or short, so minor. Image generation errors on 8 September (Images degraded 14:32 to 21:59 UTC, the page says some requests may fail), gpt-image-2.5-flare errors for 40 minutes on 16 September, limited availability of the two GPT Image 2.5 models for 40 minutes on 14 October, file download errors that listed Images for 42 minutes on 19 October, and errors on some GPT Image 2 edit requests on 30 October (14:35 to 18:36 UTC), with the 21 October API-wide degradation (22 minutes) also listing Images. Image limits published per tier on the model page, 20 images a minute on Build, 150 on Launch and 250 on Grow for GPT Image 2.5 Flare (15). 429 handling documented with Retry-After, x-ratelimit headers, backoff and a gradual ramp, re-read on 1 November (15). The 99.9 per cent Scale Tier SLA doesn't cover image models, per the 1 October check, not re-read on 1 November (0). GA (10). 20+5+15+15+0+10 = 65.

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

OpenAI Image API 85

Project API keys with restricted per-endpoint permissions, service-account keys and revocation (30). Read-only key permissions, per-project model allow-lists and spend limits. No destructive actions on the image endpoints (15). Returns generated images only, no third-party content (10). Audit Logs API records key and project events, and usage is broken down per project and key, but there's no per-request log (10). A signed security.txt with no Expires field per the OpenAI API listing's 27 October read, a public bug bounty, SOC 2 Type 2 and a trust portal, per the 1 October check, not re-read on 1 November (20).

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

OpenAI Image API 90

OpenAPI spec published in openai/openai-openapi (25). llms.txt at developers.openai.com (10). The guide says when to use Sunburst (precise edits) and when Flare (fast everyday generation), and when to use the Image API versus the Responses tool (15). Typed parameters with enums for size, quality, output_format, background and moderation, though several default to auto (13). Examples in every language and named error types such as moderation_blocked and image_generation_user_error, but no full error catalogue for images (12). Dated snapshots and a public changelog (15).