Hugging Face Inference Providers vs xAI API (Grok)

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).