Mistral AI API vs xAI API (Grok)

Mistral AI API 73

Model reading. Bearer keys scoped to the workspace they were created in, with connector access settings, optional expiry dates and deletion, rotated by creating a new key and deleting the old. Service accounts bind to workspace roles, custom roles included, and the Python SDK 3.0.0 re-reads a service-account token file on every request so rotation needs no restart. Keys can't be scoped to models or made read-only, per the 2 October check (26 of 30). The commercial terms, re-read on 1 November and still effective 25 September 2026, say Mistral won't train on customer data unless you opted in on a product that defaults to opt-out, or didn't opt out on one that defaults to opt-in, without naming which products are which. Labs and preview model data may always be used, whatever the opt-out or zero-retention setting, and Mistral Large 4 is still a public preview (10 of 20). 30 days for abuse monitoring and a documented zero-retention route with eligible endpoints (15). Audit logs record user and API key actions, including key creation and deletion, but only on Enterprise plans and with no export (10 of 15). security.txt re-read on 1 November, with a security@mistral.ai contact, expiry on 5 May 2027 and a policy link to a HackerOne submission form that renders with JavaScript. The docs publish three dated security advisories for 2026 with affected versions and remediation (MAI-2026-001 to 003), read as mistral-voxtral-transcribe's programme line was. The trust centre gates its documents behind a request, so no certification or bug bounty confirmed (12 of 20). 26+10+15+10+12 = 73.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Mistral AI API 40

No machine payment protocol (0). Per-token prices published without a login, re-read on 1 November. Mistral Large 4 is now listed at $0.70/$2.10 with cached input at $0.07 (the 17 October check read $1.36/$4.18 with a launch sale), and cached input is 10% across the range (20). Timestral has no API price because it isn't served on the API. Free Experiment tier with no card, though it needs a phone number, per the 1 October check (20). Browser sign-up (0). 0+20+20+0 = 40.

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Mistral AI API 80

Closed service with clear terms, SDKs Apache-2.0, and several models published as open weights. Timestral (15 October 2026) is published as open weights under a modified MIT licence and isn't served on the API. Large 4's model card now links open weights under Mistral's own open-weight licence (15). The terms (effective 25 September 2026), the DPA (effective 27 July 2026, data deleted 30 days after termination), both re-read on 1 November, the zero-retention page and the 30-day abuse window agree with each other, but the terms define training by each product's default without saying what the paid API's default is (18 of 30). Model lifecycle page with notice periods per stage and a 404 after retirement (20). The DPA points to a subprocessor list at trust.mistral.ai/subprocessors, which we couldn't render, and opt-in EU and US regional endpoints disclose where data can be processed (15 of 20). 15+18+20+15 = 68.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Mistral AI API 50

Status page at status.mistral.ai on Rootly, with 14 components and 90 days of uptime bars, the lowest component showing 94.36% on 1 October (20). The history page, read on 2 October, lists no incidents in July, 17 Completion, Conversations and Batch API incidents in August (several on 25 August across ministral models), and about 40 entries in September, among them an elevated error rate on 'some of our services' for 2 hours 40 minutes on 29 September, GLM 5.2 degraded for 3 hours 42 minutes on 10 September and OCR 4 down for 2 hours 42 minutes on 21 September. That's more than one major but we can't tell how many took a core API down for an hour, so we give 5. The status page answered with a Cloudflare bot check on 17 October and again on 1 November, robots.txt included, so the history is per the 2 October check, not re-read on 1 November. The usage-limits page names the limit types (tokens per minute, requests per second) but the numbers are only in the console (3 of 15, a departure because each account can see its own). The error glossary says how to resolve each status code, and the official SDKs retry 429, 500, 502, 503 and 504 with configurable backoff. No Retry-After header confirmed (12 of 15). A Priority Tier for queueing exists, no SLA found (0). Chat completions on GA models is GA (10). 20+5+3+12+0+10 = 50.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Mistral AI API 93

Public OpenAPI 3.1.0 document at docs.mistral.ai/openapi.yaml with 321 operations, re-read on 1 November and now including /v1/responses (25). llms.txt with Markdown twins of every page, re-read on 1 November (10). Reference not read in full (15 of 20). Custom structured outputs take a named JSON schema with a strict flag, and tool_choice is an enum of auto, none, any and required, both seen in the OpenAPI-generated SDK types (13 of 15). Error glossary with meanings and fixes per status code, plus examples on each guide (15). Release notes and dated model versions (15). 25+10+15+13+15+15 = 93.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).