SambaCloud vs xAI API (Grok)

SambaCloud 61

Model reading. Bearer keys from the console, up to 25 per user and shown once. No scopes, project limits or rotation guidance were found, and the key travels in a header, never in the URL (18 of 30). The terms let SambaNova access, store and process Customer Content solely to supply the service and for no other purposes, which rules out training without naming it (18 of 20). The DPA's Annex I, read on 1 November, keeps prompts, inputs and completions no more than 30 days for security, fraud and abuse monitoring. No zero-retention option was found in the pages read, and the product page says SambaCloud never sees or collects prompts, against that retention and terms that grant a right to store content and to use query logs (10 of 15, between deepseek-api's 5 and siliconflow's 6 with no period stated and the 15 groq, mistral-api and xai-api take for 30 days with a zero-retention route). The console has a Usage page. No request logs or audit log were found in the docs (5 of 15). The trust centre states SOC 2 Type 2 and ISO 27001. No security.txt, disclosure policy or bug bounty was found, and the SDK's SECURITY.md sends service reports to a general address (10 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

SambaCloud 85

Hosted reading. Status page at status.sambanova.ai on Statuspage, with components for the API gateway, the Playground and each model, read from the page itself on 1 November (20). Its history.atom feed, read on 1 November (the 8 October reading came from the /api/ path, which robots.txt disallows, and is struck), has nothing newer than an 8-minute Playground login fault on 25 June 2026, so nothing is posted for the window from 3 August (30). Limits published per model and tier, 20 requests a minute and 20 a day on the free tier, 60 and 12,000 on the Developer tier, per the 8 October check, not re-read on 1 November (15). x-ratelimit-* headers on every response, the error table says to retry queue_full after a delay, and the SDKs retry 429 and server errors twice with backoff, per the 8 October check. No Retry-After header was found in the docs or the OpenAPI document (10 of 15). No SLA found on the legal page, re-read on 1 November, or in the terms (0). Three production models are generally available, the rest previews, per the 8 October check (10). 20+30+15+10+0+10 = 85.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

SambaCloud 67

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with tool_choice to force a function, on six listed models, and a July 2026 fix for tool calls that were buffered when streaming (17 of 20). json_object and json_schema output, best effort only, with a known failure on DeepSeek-V3.2 recorded in July 2026 (8 of 15). Automatic prompt caching on the MiniMax models only, with cached input on MiniMax-M3.1-Flash at a tenth of the input price on the 1 November pricing page, a 4,096-token minimum and no guaranteed persistence (10 of 15). 131,072-token context on four of six models, 1M on the MiniMax-M3 preview, and output capped at 7,168 tokens on DeepSeek and 3,072 on Llama 3.3 70B (8 of 15). No batch API found in the docs index or the OpenAPI document (0 of 10). Official SDKs for Python and TypeScript, and the OpenAI and Anthropic clients work with a changed base URL (10). Errors carry type, param, code and request_id (14 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

SambaCloud 40

No machine payment protocol (0). Per-token prices on the pricing page, read without a login on 1 November, such as gpt-oss-120b at $0.22 in and $0.59 out per 1M tokens (20). Free tier with no payment method, per the 8 October check (20). A person signs up in the console to get a key (0).

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

SambaCloud 73

Closed service with clear terms that name the entity and the governing law, and Apache-2.0 SDKs and OpenAPI document (15). The privacy policy is still dated 27 May 2023 and doesn't name SambaCloud or API inputs. A Data Processing Addendum, part of the Terms of Service, is now linked from the legal page (undated). It limits processing of customer personal data to the agreement, its Annex I says prompts, inputs and completions are processed transiently and kept no more than 30 days for security, fraud and abuse monitoring, then deleted, and it deletes customer personal data within 30 days of termination and from backups within 90. The product page's claim, re-read on 1 November, that SambaCloud 'never sees or collects any of your data or user prompts' sits beside that 30-day retention and terms that allow storing content and using query logs (16 of 30, as novita-ai's stated retention periods, below mistral-api's 18 where the DPA and other pages agree). A deprecations page with notice and removal dates back to April 2025, recording MiniMax-M2.7's 1 October removal with a 1 September notice per the 27 October read, though nothing for Mistral Large 3, per the 8 October check (14 of 20). The DPA's Annex III names 24 sub-processors with purpose and location (USA, Japan, Germany, the United Kingdom, Australia) and promises 30 days' notice of changes, though it doesn't say where inference runs for a given request (18 of 20). 15+16+14+18 = 63.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

SambaCloud 81

Public OpenAPI 3.1.1 document, still labelled version 1.2.0 though its content changed on 27 October 2026, with 10 operations and 165 schemas (25). llms.txt at docs.sambanova.ai/docs/llms.txt and a Markdown copy of each page, per the 8 October check (docs.sambanova.ai answered robots.txt with a bot check on 1 November, so it wasn't read) (10). 718 descriptions in the document, with pages for function calling, Responses, Messages and caching. When not to use a route is rarely stated (15 of 20). Typed parameters with 150 enums, and request bodies now declare additionalProperties: false, but JSON schema output is best effort and strict: true has no effect (10 of 15). Code examples in Python and TypeScript, and an errors page with 13 codes and a recovery suggestion for each, per the 8 October check (13 of 15). The spec is versioned in its repository, but the version label didn't move with the 27 October changes, the newest SambaCloud release note seen is 7 July 2026, and the models page disagreed with /v1/models on 8 October (8 of 15). 25+10+15+10+13+8 = 81.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).