Hugging Face Inference Providers vs Mistral AI API

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

Mistral AI API 91

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors), per the 2 and 12 October checks. Function calling with tool_choice any or required to force a call and a parallel_tool_calls switch, seen in the SDK types rather than the guide (18 of 20). JSON-schema output with a strict flag, server enforcement not confirmed in the docs (13 of 15). Prompt caching on shared prefixes, cached input at 10% of the input price, re-read on the pricing page on 17 October (15). 256,000-token context on Medium 3.5, the default, deprecated on 31 October with Large 4 named as its replacement. Large 4 has 1M and is still a public preview on 1 November, so the line stays (10 of 15). A stateless Responses API (/v1/responses) arrived in the 23 October SDKs. Batch at half price (10). Official SDKs for Python and TypeScript (10). Error glossary (15). 18+13+15+10+10+10+15 = 91.

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

Mistral AI API 93

Public OpenAPI 3.1.0 document at docs.mistral.ai/openapi.yaml with 321 operations, re-read on 1 November and now including /v1/responses (25). llms.txt with Markdown twins of every page, re-read on 1 November (10). Reference not read in full (15 of 20). Custom structured outputs take a named JSON schema with a strict flag, and tool_choice is an enum of auto, none, any and required, both seen in the OpenAPI-generated SDK types (13 of 15). Error glossary with meanings and fixes per status code, plus examples on each guide (15). Release notes and dated model versions (15). 25+10+15+13+15+15 = 93.

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

Mistral AI API 50

Status page at status.mistral.ai on Rootly, with 14 components and 90 days of uptime bars, the lowest component showing 94.36% on 1 October (20). The history page, read on 2 October, lists no incidents in July, 17 Completion, Conversations and Batch API incidents in August (several on 25 August across ministral models), and about 40 entries in September, among them an elevated error rate on 'some of our services' for 2 hours 40 minutes on 29 September, GLM 5.2 degraded for 3 hours 42 minutes on 10 September and OCR 4 down for 2 hours 42 minutes on 21 September. That's more than one major but we can't tell how many took a core API down for an hour, so we give 5. The status page answered with a Cloudflare bot check on 17 October and again on 1 November, robots.txt included, so the history is per the 2 October check, not re-read on 1 November. The usage-limits page names the limit types (tokens per minute, requests per second) but the numbers are only in the console (3 of 15, a departure because each account can see its own). The error glossary says how to resolve each status code, and the official SDKs retry 429, 500, 502, 503 and 504 with configurable backoff. No Retry-After header confirmed (12 of 15). A Priority Tier for queueing exists, no SLA found (0). Chat completions on GA models is GA (10). 20+5+3+12+0+10 = 50.

Hugging Face Inference Providers 20

No x402, MPP or L402 (0). Per-token prices for every model and provider published without a login in the router's /v1/models and on model pages (20). No free tier since 7 October 2026, when free users lost their included monthly credits; PRO's $2.00 of credits needs a subscription (0). Sign-up, token creation and credit purchase are browser steps (0).

Mistral AI API 40

No machine payment protocol (0). Per-token prices published without a login, re-read on 1 November. Mistral Large 4 is now listed at $0.70/$2.10 with cached input at $0.07 (the 17 October check read $1.36/$4.18 with a launch sale), and cached input is 10% across the range (20). Timestral has no API price because it isn't served on the API. Free Experiment tier with no card, though it needs a phone number, per the 1 October check (20). Browser sign-up (0). 0+20+20+0 = 40.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

Mistral AI API 80

Closed service with clear terms, SDKs Apache-2.0, and several models published as open weights. Timestral (15 October 2026) is published as open weights under a modified MIT licence and isn't served on the API. Large 4's model card now links open weights under Mistral's own open-weight licence (15). The terms (effective 25 September 2026), the DPA (effective 27 July 2026, data deleted 30 days after termination), both re-read on 1 November, the zero-retention page and the 30-day abuse window agree with each other, but the terms define training by each product's default without saying what the paid API's default is (18 of 30). Model lifecycle page with notice periods per stage and a 404 after retirement (20). The DPA points to a subprocessor list at trust.mistral.ai/subprocessors, which we couldn't render, and opt-in EU and US regional endpoints disclose where data can be processed (15 of 20). 15+18+20+15 = 68.

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

Mistral AI API 73

Model reading. Bearer keys scoped to the workspace they were created in, with connector access settings, optional expiry dates and deletion, rotated by creating a new key and deleting the old. Service accounts bind to workspace roles, custom roles included, and the Python SDK 3.0.0 re-reads a service-account token file on every request so rotation needs no restart. Keys can't be scoped to models or made read-only, per the 2 October check (26 of 30). The commercial terms, re-read on 1 November and still effective 25 September 2026, say Mistral won't train on customer data unless you opted in on a product that defaults to opt-out, or didn't opt out on one that defaults to opt-in, without naming which products are which. Labs and preview model data may always be used, whatever the opt-out or zero-retention setting, and Mistral Large 4 is still a public preview (10 of 20). 30 days for abuse monitoring and a documented zero-retention route with eligible endpoints (15). Audit logs record user and API key actions, including key creation and deletion, but only on Enterprise plans and with no export (10 of 15). security.txt re-read on 1 November, with a security@mistral.ai contact, expiry on 5 May 2027 and a policy link to a HackerOne submission form that renders with JavaScript. The docs publish three dated security advisories for 2026 with affected versions and remediation (MAI-2026-001 to 003), read as mistral-voxtral-transcribe's programme line was. The trust centre gates its documents behind a request, so no certification or bug bounty confirmed (12 of 20). 26+10+15+10+12 = 73.