Tencent Hy4 vs xAI API (Grok)

Tencent Hy4 71

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. Bearer keys limited by model, service, IP range and token quota, long-lived with no rotation (26 of 30). The terms say inputs aren't used to train Tencent Cloud's own models, and Hy4 is first party, so no third party's terms apply (14 of 20). Retention only as long as the service needs, no periods (7 of 15). Per-call audit logs and optional full logs to the customer's CLS (14 of 15). No security.txt; Tencent's TSRC bounty covers Tencent Cloud; no certification checked (10 of 20). 26 + 14 + 7 + 14 + 10 = 71.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Tencent Hy4 73

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. No OpenAPI file for inference; field pages for the OpenAI and Anthropic formats as TokenHub implements them (12 of 25). llms.txt with Markdown copies (10). The model list, updated 9 November, gives hy4's context, input and output limits and marks thinking, structured output, function calling, caching and image understanding; computer use, which Tencent's release names, isn't marked (13 of 20). Typed field pages (10 of 15). Examples in five languages and an error page of 30 codes (14 of 15). Dated release notes, with hy4 added on 4 November (14 of 15). 12 + 10 + 13 + 10 + 14 + 14 = 73.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

Tencent Hy4 45

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. No machine payment protocol (0). The price page, updated 9 November, lists ¥6 input, ¥0.3 cached and ¥18 output per million tokens, with Hy4 billed at 50% until 31 December 2026 (20). TokenHub's campaign of 1M free tokens per language model, read on 1 November, isn't confirmed for hy4 on the price page, so half (10 of 20, a judgement call). A person signs up with real-name verification (0). 0 + 20 + 10 + 0 = 30. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.

xAI API (Grok) 30

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 20 is 30.

Tencent Hy4 52

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. Closed service under the TokenHub terms, but Tencent's release headline calls Hy4 open source while the weights and system card are only promised 'in the coming days', with no licence stated, and tencent/Hy4 didn't answer on Hugging Face on 11 November (14 of 30). Terms and FAQ agree inputs aren't used for training; the privacy policy renders only with JavaScript and wasn't read (15 of 30). Dated retirement notices and shutdown fields (13 of 20). Processing generally in mainland China for the China site, Singapore for the international one (13 of 20). Every benchmark in the release is Tencent's own or a partner's. 14 + 15 + 13 + 13 = 55.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Tencent Hy4 46

Model reading for hy4 on Tencent Cloud TokenHub. Platform facts are the tencent-tokenhub listing's (checked 1 November), carried over as RULES.md allows for a model on an already graded platform. No public status page (0) and so no incident record to read (5 of 30). Per-model rate limits only in the console and DescribeModelQuota (8 of 15). Six 429 codes, Retry-After and backoff advice (13 of 15). The TokenHub SLA promises 99.5% a month, and Hy4 is Tencent's own model, so the third-party exclusion doesn't apply (10). Released as hy4 on 4 November, a separate id from hy4-preview, with no preview label (10). 0 + 5 + 8 + 13 + 10 + 10 = 46.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).