Stability AI Image API vs SurgePix API

Stability AI Image API 8

The last image release in the notes, per the listing, is Style Transfer in April 2025, but Stability's own API notebooks on GitHub added SD 3.5 Flash on 31 July 2025. Either way it's more than 180 days ago (0). Newer work covers audio, with Stable Audio 3 examples added on 14 May 2026, not images (0). Public release notes and support, not tested (5). The official Python SDK is the gRPC client last released in May 2024 (3). Nothing current to assess (0).

SurgePix API 66

The last dated change is GPT-Image-2.5 on 23 October 2026, 10 days before the check (30). Changelog entries on 15, 22 and 23 October, 16, 9 and 2 September 2026, more than three in 90 days (20). For a closed service, a dated changelog, a Discord server and a contact email. We didn't open Discord or the GitHub issues, so answering isn't confirmed (8). No official SDK. The skills are maintained client scripts with tags from v1.0.0 (4 June 2026) to v1.5.0 (2 September 2026), a judgement call (5). The repository's CI checks SKILL.md front matter only, with no tests, and the skills aren't published as a package (3). 30+20+8+5+3 = 66.

Stability AI Image API 60

Status page at status.stability.ai on Statuspage, with incident JSON (20). One incident in the last 90 days, rated major, elevated 500s on generation endpoints across the API Platform, Brand Studio and Stable Audio from 16:33 to 20:41 UTC on 14 September 2026, 4 hours 8 minutes (10). Limit of 150 requests every 10 seconds, per the listing's 30 September check (15). A 429 locks the caller out for 60 seconds, documented, but no Retry-After or backoff advice (10). No SLA (0). The endpoints agents call sit under /v2beta (5).

SurgePix API 15

Read with the hosted lines. No status page was found on surgepix.ai or in the docs, and status.surgepix.ai doesn't resolve (0). With no history to read, the incident line takes the floor (5). No rate limits with numbers are documented. The terms say "non-human continuous or frequent query operations" lead to automatic account suspension, with no threshold given (0). No 429 or backoff guidance. The skill scripts poll every 2 seconds for up to 5 to 15 minutes, but that is client code, not a documented policy (0). No SLA, and the terms disclaim uninterrupted service (0). The API isn't labelled beta or preview, and API keys have been self-serve since 2 June 2026 per the changelog (10). 0+5+0+0+0+10 = 15.

Stability AI Image API 61

Closed API under terms that took effect on 30 September 2026. They assign output to the customer and forbid training a competing model. SD 3.5 weights are public under Stability's community licence, not an OSI licence (15). The privacy policy (effective 31 July 2025) says inputs and outputs may be used for training with an opt-out, and gives no retention period for API content (10). Dated notices for the July 2025 end of SVD and SD 1.6 and the August 2025 price rise (10). Processing in the US with controllers named per region, no subprocessor list (5).

SurgePix API 28

The editorial half. A closed service whose terms name no company or address. They restrict any commercial use of what the service produces without SurgePix's permission, and contain clauses from an unrelated product (a "big data" query platform and "non-resume content"). The skills are MIT. Unclear terms, with a little credit for the open skills (5). The privacy policy is dated both 10 June 2026 and 1 July 2022, describes WeChat and phone registration and "domestic servers", and gives no retention periods. The API reference says uploads go to Tencent Cloud storage in Seoul as public URLs. No DPA. The statements don't agree (5). No deprecation policy or notices, and the terms let changes take effect on publication without notice (0). Tencent Cloud Object Storage in ap-seoul is named in the API reference, and Alipay and WeChat Pay in the privacy policy. No subprocessor list or stated data location (4). 5+5+0+4 = 14.

Stability AI Image API 40

No x402, MPP or L402 (0). Fixed credit prices per call published at $0.01 a credit (20). 25 free credits on sign-up (20). Browser sign-up (0).

SurgePix API 20

No x402, MPP or L402 (0). Plan prices and monthly credits are public, but credits are spent per token with no per-call price for any API task, so plan-only pricing (10). A free plan with 25 credits a day. The pages don't say whether a card is needed or whether a free account can create API keys, so half, a judgement call (10). A person signs up in a browser and creates the key in settings (0). 0+10+10+0 = 20.

Stability AI Image API 30

One bearer API key per account from the platform page, no scopes found (20). No least-privilege mode or spend cap found (0). Returns generated images only (10). No per-call log found (0). No security.txt, and no bug bounty or certification found (0).

SurgePix API 41

Plain API keys created in the account settings, which the docs say can be revoked and reset. The key goes in the authorization header, never in a URL. No scopes found (20). No read-only key or spend cap. The plan's credit allowance bounds spend. Every uploaded file becomes a publicly accessible URL on Tencent Cloud storage, which counts against least privilege (3). The API returns image and file URLs, not untrusted text (10). The billing page's credit statement lists each request with its model and token counts, and sessions group calls in the web app, per the docs (8). No security.txt, disclosure policy, bug bounty or certification was found (0). 20+3+10+8+0 = 41.

Stability AI Image API 48

accept: image/* returns raw bytes and application/json returns base64, so an agent can choose but never gets a URL (18). Format and aspect ratio controls (12). Error responses not checked in this run (8). No idempotency key, and some edit and upscale endpoints are async jobs to poll (5). The only official SDK is the legacy gRPC client from May 2024 (5).

SurgePix API 53

Every task returns one download URL, or one ZIP for an image set, and status responses are a few fields, so little enters context (18). Nothing to paginate. noWait chooses sync or async, and the skills pass size, aspect ratio, count and language, but none of these are in the public reference (10). Errors come back as a JSON code and msg, with 401 and 404 documented and an NSFW error on upload, but a failure can arrive as HTTP 200 with a non-zero code and failed task states carry no documented reason (12). Upload deduplicates by MD5 and returns the existing URL. Tasks have no idempotency key, and a retried task is a new task that spends credits again (5). Few required parameters (fileUrl for background removal). No official SDK, only the Node scripts inside the skills (8). 18+10+12+5+8 = 53.