StepFun API vs xAI API (Grok)

StepFun API 41

Model reading. Bearer API keys, revocable by deletion. Organisations can create one key per project, billed to a project's credit with a per-member cap. No scopes or read-only keys found (20 of 30). Training on API data is not off by default in plain words. The privacy policy (effective 7 August 2026) says StepFun may use and retain data to improve its models, including training and fine-tuning where law and program terms permit, and the terms name early-access programmes as one such case. No opt-out found (5 of 20). No retention period for prompts and outputs and no zero-retention option. IP addresses are kept three years (3 of 15). The console's usage details list each billed call by key, model and date, with export (8 of 15). No security.txt, bug bounty or certification found. A DPA with breach notification exists (5 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

StepFun API 53

No OpenAPI or similar machine-readable contract found. The API reference is Markdown pages (0). llms.txt at platform.stepfun.ai/docs/llms.txt, and every page has a Markdown copy (10). The Chat Completions reference describes each parameter with its default, and the model page lists what Step 5 Preview supports, but little on when not to use an option (12 of 20). Tool definitions take JSON Schema parameters, structured output takes a JSON Schema with strict: true, and reasoning_effort is an enum of low, medium and high. No tool_choice parameter is documented (11 of 15). Worked requests and responses on each page, and an error table of eight codes with causes and fixes, but no error bodies (12 of 15). No API changelog. A model lifecycle page with dated retirements and announcement pages (8 of 15).

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

StepFun API 28

No status page read. status.stepfun.ai refused our reader by robots.txt and the shell couldn't connect, so we couldn't establish whether it is a status page or read any history. Scored absent for both lines, with 5 for unreadable history, and named in the open questions (0 + 5). Rate limits published with numbers per tier, from 5 concurrent, 100 RPM and 500,000 TPM to 130, 2,600 and 13,000,000 (15). The error and exception guides say to retry 429, 500, 503 and 504 after a short delay, with no Retry-After header, backoff schedule or idempotency guidance (8 of 15). No SLA found in the terms or pricing (0). Step 5 Preview is labelled a preview (0).

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

StepFun API 50

Model reading. The image models step-2x-large and step-image-edit-2 were retired on 10 October 2026, and a Step 5 Preview price change is announced for 14 October (30). No stated notice period. The 10 October image retirement had a dated notice page and the July retirements a migration table, but we couldn't date when either notice went up (4 of 12). One retirement date in the last 90 days, 10 October, with nine models retired on 8 July just outside that window (6 of 8). Dated announcements, a Discord server and platform@stepfun.com for support. We didn't test whether either answers (10 of 15). No official SDK (0 of 15, 0 of 10).

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).

StepFun API 68

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calls through Chat Completions, Responses and Messages, with no documented way to force or forbid a call (15 of 20). Strict JSON Schema output on Step 5 Preview (13 of 15). Prompt caching with a published cache-hit price at a tenth of the miss price (15). 1M-token context and 64k output (15). No batch endpoint found (0). No official SDK. The docs use the OpenAI and Anthropic clients against compatible endpoints (0). Eight error codes with a fix each, plus finish_reason handling for length, content filter and tool calls (10 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

StepFun API 57

Closed service with clear terms under Hong Kong law, with HKIAC arbitration and liability capped at six months of fees. Some earlier Step models have open weights, which doesn't change the hosted service (15). The privacy policy, terms and DPA agree that data may be used for training under program terms, but the terms' licence to Content is broad and perpetual, no retention period is given for prompts and outputs, and no subprocessor list was found (12 of 30). A model lifecycle page with dated retirements and replacements (14 of 20). Servers are disclosed as in the United States. The DPA gives general authorisation for subprocessors without a published list (10 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).