Vercel AI Gateway vs xAI API (Grok)

Vercel AI Gateway 79

Hosted reading. AI Gateway is a component on www.vercel-status.com (20). The history feed, re-read on 1 November 2026, has 25 entries from 23 July to 23 October, so it covers the whole 90 days from 3 August. None names AI Gateway in its title or text. The Drains, Logs and Observability incidents (6, 17 and 20 August, 16 to 17 September, 10 October in Washington, which names delayed logs, metrics and traces in general, and 23 October) name no AI Gateway surface, and none reports requests failing. Component tags sit in the status API, which robots.txt disallows, so they were not used. A readable page that posts incidents, none touching the product, is a clean record, as vercel-connect's incidents were read from the same feed (30). The rate-limit page, re-read on 1 November, says it describes behaviour rather than fixed numbers. The paid tier has no gateway limit, and the free tier's per-model limits are not published (5 of 15). A 429 has a documented JSON body, some carry retry-after, the docs give backoff code and separate a 429 from a 402 budget rejection, and failed provider attempts are retried on other providers (14 of 15). The Enterprise SLA excludes the APIs and CLI, and no SLA naming AI Gateway was found (0). Generally available since 21 August 2025. Token Pass is early access and the Python SDK is in beta (10).

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Vercel AI Gateway 79

Router, read on the model lines. AI Gateway API keys belong to a team, can be limited to one project and given an expiry and a budget, are deactivated when their creator leaves the team, and can be revoked without authentication by reporting a leaked key. Keys carry no per-model or read-only scope apart from the Token Pass key type. On Vercel, project OIDC tokens replace long-lived keys (24 of 30). Vercel says it does not train on prompts, and the AI Product Terms make that a warranty only for Enterprise subscriptions. Provider training is filtered only when disallowPromptTraining or ZDR is set, the filter does not apply to BYOK, and the terms say Stealth Model providers may train on inputs (12 of 20). The gateway does not keep prompt or response content. Provider ZDR is free per request on Pro and Enterprise and not available on Hobby, and BYOK keys are skipped under ZDR unless marked (12 of 15). Per-request logs record status, provider attempts, tokens, cost and authentication method, with routing details kept 30 days and Trace Drains and spend reports on paid plans (13 of 15). Valid security.txt with HackerOne (re-read on 1 November, expires 28 September 2027), SOC 2 Type 2 and ISO 27001:2022 as Vercel states them, and a public bulletin for the April 2026 incident, closed on 16 October 2026 (18 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Vercel AI Gateway 74

Router, scored on the API lines. Vercel's OpenAPI 3.0.3 document has AI Gateway management paths (budgets, routing rules, virtual model configs, routers) and POST /api-keys. It does not cover the inference routes on ai-gateway.vercel.sh or /v1/models, /v1/credits, /v1/generation and /v1/report, which follow the OpenAI and Anthropic formats and the REST reference page (12 of 25). Every docs page is served as Markdown, and vercel.com/llms.txt lists AI Gateway and the keyless model list (10). The docs say when to use AI Gateway, which API format suits which client, and what each control leaves out, such as BYOK spend outside budgets (16 of 20). providerOptions.gateway fields are documented in tables with types, and the model list names each model's supported parameters. The request bodies have no published schema of their own (9 of 15). cURL, TypeScript and Python examples on most pages, and error tables in the FAQ, the REST reference and the Token Pass pages. The Chat Completions error list omits 402 (13 of 15). Paths carry /v1, the changelog is dated, with 95 entries naming AI Gateway from 3 August to 30 October 2026, and @ai-sdk/gateway keeps a CHANGELOG. The changelog sitemap dates one AI Gateway entry to 25 March 2025, before the alpha (14 of 15).

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

Vercel AI Gateway 71

Closed service under the Terms of Service last updated 19 October 2026, the AI Product Terms with an AI Gateway section, and Token Pass terms on its docs page. Routed models carry the terms of 64 providers listed in the Notices and Licence Information, and the SDK is Apache-2.0 (18 of 30). The FAQ, the ZDR page and the logs page agree that prompt and response content is not kept. The terms place content sent to providers under the providers' own terms, give the no-training warranty only to Enterprise and bar sensitive personal information in Input. The DPA covers Pro and Enterprise, not Hobby, and the privacy notice gives retention criteria, not periods (17 of 30). No deprecation policy found. Model retirements carry dates in the model list, and the AI Product Terms let Vercel change fees, change or end anything in beta without notice, and end Token Pass with a pro-rata refund (8 of 20). Provider terms are listed per provider and regional inference names four regions, while the gateway itself may process a request in any Vercel region. The subprocessor list on security.vercel.com was not read (12 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Vercel AI Gateway 83

Router, read on the model lines. Tool calling is documented on all six surfaces and 303 of 498 models carry the tool-use tag on 1 November, with behaviour depending on the model routed (16 of 20). Structured output is documented per surface and tagged on 278 models (13 of 15). caching: 'auto' adds Anthropic cache markers, cache_ttl asks for one-hour entries, x-session-affinity keeps a conversation on one provider, and cache-read prices are listed per model (14 of 15). 162 models list a context of one million tokens or more, a judgement call since a router has no default model (15). The SDK source has a gateway-batch.ts file, but no batch endpoint or batch discount was found in the docs (2 of 10). The AI SDK for TypeScript, the AI SDK for Python in beta, and the OpenAI and Anthropic SDKs with a changed base URL (10). Errors return message and type, an exceeded budget answers 402 apart from a 429, the SDK has ten typed Gateway*Error classes, and the FAQ maps each status to a fix (13 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).