Seedream on BytePlus ModelArk vs SurgePix API

Seedream on BytePlus ModelArk 62

Closed service under a public Customer Agreement and Service Specific Terms. The General Terms for AI Services, which the model terms rely on, did not load for us, so output ownership is not established (13). The data processing page and the ModelArk terms agree that customer data is not used for training without opt-in, name 180 days' retention for filter-triggered content and list processing in Malaysia, Indonesia and the EU or EEA. The Privacy Policy excludes customer data and points to a DPA we did not read (20). A deprecation process with dated batches, named replacements and a 30-day minimum (16). A sub-processor list effective 24 September 2026 with locations and 15 days' notice of changes, which has no row for ModelArk (12).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Seedream on BytePlus ModelArk 70

API keys are scoped to a resource project and region, can be limited to named model IDs or endpoints and to an IP allowlist, and can be disabled or deleted. No expiry or rotation feature was found. The key travels in a header (26). Model-level key permissions, per-endpoint rate limits and account inference limits narrow what a key can spend, with no read-only notion for a generation API (12). The API returns generated images only (10). The console shows each key's last use and creator, and a usage query API exists. The inference security audit covers only Skylark models (8). No security.txt. The SDK repositories send reports to ByteDance's security centre, which runs a bounty, and the trust centre lists ISO 27001, SOC 2 and PCI DSS for BytePlus as a whole (14).

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.

Seedream on BytePlus ModelArk 43

Graded as a hosted service. No status page or incident history was found in the docs or the site pages read (0), so the 90-day record is scored as unreadable (5). The model list gives 500 images a minute for each Seedream model, with a note that limits are theoretical maximums and not guaranteed (15). The error reference lists 15 distinct 429 codes including ModelAccountIpmRateLimitExceeded, and a burst-traffic guide gives exponential backoff with jitter. No idempotency key was found (13). The legal index lists SLAs for 16 other BytePlus products and none named for ModelArk. We did not open those documents (0). The image API is not labelled beta or preview (10).

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Seedream on BytePlus ModelArk 62

No OpenAPI file for the data plane was found. The Go and Python SDKs publish typed request and response models, and an API Explorer page exists that we did not read (8). No llms.txt or Markdown docs for agents were found, and the docs site is drawn by script (0). Each parameter states its purpose, the models that accept it and its restrictions (15). Inputs carry types, defaults, enums and pixel and aspect-ratio ranges, though size is a string with two exclusive formats (13). The tutorial has curl, Python, Java, Go and OpenAI SDK examples, and the error reference maps HTTP status to code, message and meaning (14). The path is versioned at /api/v3, model IDs carry a date, and release pages are dated by month (12).

SurgePix API 40

No OpenAPI or other machine-readable contract was found (0). surgepix.ai/llms.txt returns 404. The docs are HTML pages, but the 15 SKILL.md files in the MIT repository are Markdown written for agents, so half (5). The API reference states the purpose of each of its five operations and the async and session model. The SKILL.md files add trigger phrases and explicit do-not-use routing between skills, but 11 of the task endpoints the skills call appear only in their scripts, with no reference (10). Parameter tables give type and required for the documented operations, with no enums or limits, and the undocumented endpoints have no schema at all (7). JSON examples for every documented operation and an error table with 401, 404 and error.file.sensitive_content (10). A dated public changelog from 11 March 2026, but no version in the API path and no API-specific change notes (8). 0+5+10+7+10+8 = 40.

Seedream on BytePlus ModelArk 72

Graded on the model lines. Responses can be a URL or b64_json, size takes resolution levels, and max_images caps a batch (20). There is nothing to paginate. Sequential generation, streaming and per-request output controls cover size (14). Errors carry a code, a message and a request ID, and a failed image in a batch reports its own error without failing the rest (17). No idempotency key was found. The SDK retries twice by default, and images that fail are not billed (6). Only model and a prompt or image are needed, with SDKs in Python, Go and Java and OpenAI SDK compatibility (15).

SurgePix API 53

Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. noWait chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON code and msg, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero code and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (fileUrl for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.

Seedream on BytePlus ModelArk 73

Graded on the model lines. Seedream 5.0 flash (dola-seedream-5-0-flash-260915) is in the September 2026 release table and the deprecation page was last updated on 10 September 2026, 29 days before the check (30). The deprecation process promises at least 30 calendar days' notice and the last two batches gave about eight weeks, but the page says each version is usually retired a few months after launch, and Seedream 3.0 went in May 2026 (12). Dated release and update pages are public, with tickets and a Discord community for support, which we did not test (8). Official SDKs are current. The Python SDK reached v3.0.61 and the Go SDK v0.9.0 on 17 September 2026 (15). Both SDK repositories have CI workflows (8).

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.