Novita AI vs xAI API (Grok)

Novita AI 65

Model reading. Bearer keys with the sk_ prefix, shown once, up to 10 an account, with an expiry of 24 hours, 30 days, 90 days or none fixed at creation, deletable in the console, and a per-key model access policy and source IP allowlist that can be set by API. OAuth with PKCE and the scopes api and balance:read is described in auth.md, with no token revocation endpoint. No documented way to send a key in a URL was found (26 of 30). The terms, re-read on 4 November and still updated 5 August 2026, say content is not used to train Novita's models or improve the services by default (17 of 20). The terms state zero data retention, with exceptions for law and for what is necessary to run or support the service, and allow automated safety screening. Batch input files are kept for 15 days (11 of 15). Billing can be queried per key, and budget, monitoring and metrics pages are listed in the docs index and were not read (7 of 15). The trust centre at trust.novita.ai is drawn by script and was not read. /.well-known/security.txt returns 404, and no disclosure policy or bug bounty was found (4 of 20). The key, retention and trust-centre readings are per the 9 October check, not re-read on 4 November.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Novita AI 28

Hosted reading. No status page was found. None is linked from the home page, the pricing page, the docs introduction, either llms.txt or the docs site map (0), so there is no incident record to read (0). The rate limit page documents five account tiers set by monthly top-ups, from under $50 to $10,000 and over, and limits counted in RPM and TPM per model. The figures per model are drawn by script and were not readable, so this line takes part marks (8 of 15). 429 with RATE_LIMIT_EXCEEDED or TOKEN_LIMIT_EXCEEDED, advice to throttle and use exponential backoff, and a billing page that says 429, 500, 503 and 504 are not charged. No Retry-After header was found (10 of 15). No SLA was found. The home page states 99.5% uptime, and the terms say availability is not guaranteed (0). Generally available (10). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Novita AI 62

Model reading. The OpenAPI 3.1.0 document at /.well-known/openapi.json is a 964-byte discovery file with four paths and no schemas, and the API reference is written by hand (6 of 25). llms.txt on both hosts, a Markdown copy of every docs page and an llms-full.txt (10). Guides for function calling, structured output, prompt caching, batch and reasoning say what each is for, and the chat reference describes 136 request and response fields (14 of 20). Fields are typed with required flags and defaults. Enums and ranges are stated in prose only (10 of 15). Curl and Python examples on each guide, error tables by product, a common errors guide and a table of which statuses are billed. The FAQ says json_schema and top_logprobs are unsupported while the reference and a guide document both (10 of 15). A dated changelog with 84 entries since February 2024. The API has no version scheme beyond /v1 (12 of 15). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

Novita AI 72

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). tools with a strict flag and a worked example. The list of models that support it is drawn by script, and tool_choice is absent from the chat reference (13 of 20). response_format takes json_object and json_schema with strict in the reference, while the FAQ says only json_object works (9 of 15). Prompt caching is automatic on supported models, cache-read prices are on the pricing page and cached_tokens is returned in usage (12 of 15). Context of 1M tokens on DeepSeek V4, GLM 5.3 and Kimi K3 per the pricing page. Output caps were not read (12 of 15). OpenAI-style files and batches with a 24-hour window, one model per file and an introductory 50 per cent discount (10). The OpenAI client works with a changed base URL. Both vendor SDK repositories are archived (5 of 10). Named error codes, a 429 that separates request and token limits, and a trace_id for support (11 of 15). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

Novita AI 35

No machine payment protocol was found in the docs index, the site map, the pricing page or the skill repository (0). Per-token prices for each model on the pricing page without a login, such as deepseek/deepseek-v4.1-flash at $0.30 in and $1.20 out per 1M tokens (20). Two language models are listed as free and the FAQ describes a voucher for new users. Whether a card is needed to use either was not stated in the pages read (15 of 20). A person signs up in a browser, keys are created only in the console, and the OAuth route needs the user to sign in and approve (0). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Novita AI 66

Model reading. Changelog entries per the 27 October reading of each entry page, not re-read on 4 November because Novita's terms bar automated access to the site and its linked channels. The newest entry is dated 22 October 2026 (30). Retirement notices carry a UTC time and a replacement, with notice of 1 day (22 October for xiaomimimo/mimo-v2.5 at 00:00 UTC on 23 October) to 29 days (1 September for multimodal models on 30 September). No written notice period was found (6 of 12). Nine dated entries in the 90 days from 6 August (1, 8, 18, 20, 23 and 28 September, 15, 19 and 22 October), each read on its own page (8 of 8). A dated changelog, a Discord server and a support address per the 9 October check (12 of 15). novitalabs/python-sdk and novitalabs/javascript-sdk are archived, unchanged since 8 November 2024 and 4 March 2025, and issue replies were not examined (2 of 10). The docs rely on the OpenAI client, the SDK page still named the two archived packages on 9 October, and the skill repository is unchanged since 24 September 2026 (5 of 15). The JavaScript SDK repository has a publish workflow only and the Python one has none (3 of 10). 30 + 6 + 8 + 12 + 2 + 5 + 3 = 66.

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).