SpaceXAI / Grok API

Executive Summary

SpaceXAI is the current branding of the Grok model and product business. SpaceX announced its acquisition of xAI on February 2, 2026; Cursor announced its completed acquisition by SpaceX on August 14. The public developer interfaces retain x.ai, api.x.ai, and xAI SDK names.^[1][2][3][4]

For builders, its most consequential offering is a hosted model API with managed search, analysis, document retrieval, media generation, and speech. It also sells finished agent products. A Grok API request, a Grok Build coding session, and a Grok Bot running a persistent computer are different deployment choices with different controls. This profile maps the platform; the linked profiles examine those products in depth.^[4][5][6]

---

Product Overview

Product surfaces

The official plugin marketplace is another distinct layer: a catalog for Grok Build packages containing skills, commands, agents, hooks, MCP servers, or language servers. Its README explicitly disclaims verification of third-party packages and says each has its own license. Installing an extension therefore requires reviewing its source and privileges; catalog inclusion is not a security certification.^[15]

Grok Skills in the app stores reusable instructions and procedures across conversations, with built-in document, spreadsheet, presentation, and PDF capabilities. Its May announcement covers web, iOS, and Android.^[16] Grok Bot's learned skills and routines belong to its ongoing assistant workflow. These are distinct from the Build plugin catalog; the reviewed sources do not establish automatic library synchronization among all three.^[6][15]

Models and version selection

The catalog currently spans general text/reasoning models, a beta multi-agent model, and separate image, video, and speech families. These are endpoints and releases within one platform, rather than separate companies or independent agent frameworks.^[17]

Grok 4.6 supports low, medium, high, and xhigh reasoning, with high the default. Its documented knowledge cutoff is February 1, 2026, so answering a later factual question still requires supplied context or retrieval. The guide recommends a prompt_cache_key to improve cache reuse across a conversation and points long tool loops toward context compaction.^[8]

Choose a model using its exact capability and pricing page. The current 4.6 page says Batch API is unsupported; the existence of a platform Batch API does not make every model eligible. Moving aliases also require regression checks when underlying releases change.^[18][17]

---

Technical Architecture

What runs where

The API offers two execution patterns. For built-in tools, the service can search, execute the configured tool, inspect results, and continue until it returns an answer. For custom function calling, it returns a request for application code to execute. The application owns that function's permissions and side effects.^[9]

That distinction determines how to design approvals and retries. A server-managed research request can contain several tool invocations; it is not necessarily one model generation or one billable search. A custom function boundary gives the application a place to validate arguments and request human approval before carrying out a write.^[9] The latter is an implementation recommendation, not a claim that every tool has a built-in approval screen.

Remote MCP is connectivity, not a complete approval system

Remote MCP supports Streaming HTTP and SSE, an external server URL, authentication headers, and a tool allowlist. Omitting allowed_tools, or passing an empty list, exposes all tools published by that server. The native SDK uses allowed_tool_names for that field.^[19]

The documentation explicitly says require_approval and connector_id are unsupported. Do not port a Responses client and assume those controls are enforced. For a read-only research workload, expose only read tools and use narrowly scoped server credentials. For consequential writes, put authorization in the destination or an application-controlled execution path. The reviewed API is not evidence of a managed connector provisioning and OAuth lifecycle product.^[19]

Python analysis is not a reusable agent computer

Code execution provides Python and common analysis packages, including NumPy, pandas, Matplotlib, and SciPy. The documented environment restricts network/filesystem access and does not persist execution state across requests. Passing prior conversation messages is not a promise that the previous Python process or working directory survives.^[20]

This is useful for calculating from supplied data and checking intermediate results. It does not establish arbitrary package installation, a permanent repository checkout, a long-running service, or the isolation guarantees of a particular hypervisor. Evaluate agent sandboxes separately when an application needs its own execution environment.

Beta multi-agent research

The beta grok-4.20-multi-agent interface delegates research to four or sixteen agents. The native API exposes agent_count; the Responses interface selects those sizes through reasoning effort. It supports managed tools and remote MCP, but not client-side custom function tools. It also excludes Chat Completions and the usual max_tokens parameter.^[21]

The returned transcript exposes the leader's final response and tool calls. Subagent state can be carried as encrypted content, rather than a readable transcript of every worker. Tokens and tool calls across the group contribute to the bill.^[21]

That makes it a hosted research configuration to evaluate against a single-agent baseline. It does not establish a general-purpose orchestration framework, reproducible ML experiment runner, or independently demonstrated quality advantage from using more agents.

Files, Collections, and administration

Files attach document context to a conversation and automatically activate attachment_search. The model can search several times within one answer, incurring tool charges. Collections add persistent indexed storage and semantic retrieval across document sets, with metadata and chunking controls.^[22][23]

Use attachments for a bounded document question; consider Collections for a maintained corpus. Neither removes the need to inspect what was retrieved, handle revisions, or enforce access in the application. A useful pilot checks missing-document and outdated-document cases, rather than only questions with obvious matches.

The Management API uses a separate management key and management-api.x.ai endpoint. It manages inference keys, endpoint/model access, rate limits, and administrative audit information. Key changes have propagation status; lowering a rate limit rejects excess new requests rather than cancelling work already in flight. Administrative audit events should not be mistaken for a complete trace of agent actions.^[24]

---

Media and Speech

Imagine covers image generation/editing and asynchronous video generation, with polling for completion. Reference inputs and edit operations have different input/output costs; a text-model response does not imply image or video output support. The appropriate Imagine endpoint and model must be selected.^[25]

Recent release notes illustrate why aliases matter: Image 2.0's auto quality setting resolves differently for generation and editing, and billing follows the resolved quality. The notes also announce a November 2, 2026 redirect of the grok-imagine-image-quality slug to Image 2.0 low quality; the original image model is separately described as unaffected. Treat that as an announced migration, not a change already in force on this review date.^[26]

Speech has three interfaces: real-time speech-to-speech over WebSocket, text-to-speech, and transcription. Client applications can use ephemeral tokens instead of embedding a long-lived API key. The voice profile covers protocol behavior and deployment considerations in more detail.^[14]

Custom voices have narrower availability than the general speech API: the documentation lists the United States excluding Illinois, console creation, and Enterprise-only creation through the API. Voice references are stored and can be downloaded or deleted. This is one reason not to apply a general voice-overview statement about audio handling to every voice feature.^[27]

---

Privacy, Retention, and Regional Boundaries

The API security FAQ states that inputs and outputs are not used for training without permission. Ordinary request/response retention is 30 days. Team-wide zero data retention changes that behavior and applies across the team's keys; the response header x-zero-data-retention exposes whether it is active.^[28]

ZDR has functional consequences. Stateful Responses chaining, Files, Collections, Batch, Deferred, and stored media/voice-history features are disabled. Client-held conversation history and supported encrypted-content flows are the alternative. Existing stored data must be addressed during setup; ZDR is not a command to make a persistent retrieval corpus both disappear and remain usable. Administrative metadata still exists.^[28]

For a residency-sensitive application, routing inference to the US URL does not by itself solve retrieval and tool-data placement. Review the whole path, including external MCP destinations.

Consumer Grok has a different policy scope. Its privacy policy excludes business/API processing governed by customer agreements and distinguishes Grok on X. Consumer terms describe model-improvement controls and private/deleted-chat handling; those settings are not interchangeable with the API's team ZDR control.^[30][31]

Grok Bot adds another product boundary: Cursor manages the computer, model selection, account permissions, and enterprise controls. The Bot documentation separates model-training Privacy Mode from the persistent state needed to keep working. Use the Bot security discussion for that deployment instead of copying API retention claims onto it.^[10]

---

A Practical API Evaluation

The documented starting point is a console account with credits and an API key. A minimal Responses request can establish connectivity before introducing retrieval or side effects:^[7]

curl https://api.x.ai/v1/responses \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "grok-4.6",
    "input": "Explain why an empty input list needs an explicit policy in a median function."
  }'

This documentation-based example was not executed for the report. It requests an explanation, not permission to edit or run code in a repository.

For a research pilot, add one read-only source at a time. First compare the model's answer against a known document. Then add web or collection search, record retrieved sources and tool counts, and test a question for which the correct answer is “not established.” The API supplies citation data for tool-grounded answers; the application should preserve and inspect that attribution rather than treating a fluent answer as verified.^[32]

Before production, evaluate these practical outcomes:

• Task success: Did the answer satisfy a checkable requirement and accurately represent the source?
• Access behavior: Could the model invoke only the tools and records intended for the task?
• Complete cost: Include retries, intermediate reasoning, tool calls, retrieval storage, and output handling.
• Version stability: Repeat the same cases after model, alias, prompt, or SDK changes.
• Failure recovery: Check timeouts, incomplete retrieval, revoked credentials, and partial writes before granting broader permissions.

These are recommended evaluation criteria. This report does not supply a latency, reliability, or quality benchmark.

---

Strengths and Cautions

Strengths

• Several useful components behind one API. Search, calculation, retrieval, and model generation can be combined without implementing every server tool yourself.^[9]
• A path from models to finished workflows. Build and Bot address different coding and ongoing-work needs, with product-specific profiles available for deeper evaluation.^[5][6]
• Documented operational choices. Management keys, ZDR behavior, and regional exclusions give teams concrete controls and tradeoffs to assess.^[24][28][29]

Cautions

• Compatibility has exceptions. MCP approval fields, multi-agent client tools, model-specific Batch support, and endpoint regions must be checked individually.^{[19][21][18][29]}
• A feature-rich request has more than a token price. Managed searches, multi-agent work, storage, and media introduce additional meters.^[33][21]
• Privacy choices change architecture. Persistent retrieval and strict ZDR cannot simply be enabled together.^[28]

What Developers Say

On August 16, 2026, GitHub user NYTEMODEONLY requested documented API access to the Build and voice quota information visible in the console. On September 12, bcorn2006-art, describing a quota-advisory bot they were building, explained that a developer prepaid balance did not answer their consumer weekly-pool use case. Both accounts are marked without repository association; the issue remained open when checked September 16.^[34]

This is a concrete integration report, not a platform-wide reliability survey. It supports checking whether the exact usage meter needed by an application has a documented API. It does not establish that every billing metric is unavailable. The discussion review found this more actionable than unmeasured claims about model quality; no independent comparative benchmark was performed here.

---

Pricing and Licensing

Prices below are USD, checked September 16, 2026. Billing depends on the product and account entitlement. Grok's FAQ describes shared weekly allowances and a product usage breakdown, while the developer quickstart uses console credits. A consumer subscription allowance should not be equated with an unrestricted developer balance.^[35][7]

Hosted API meters

The larger-context tier applies to all tokens in that request, not just those above the threshold.^[18]

Tool and storage charges add to applicable model charges; speech uses its own meters. Remote MCP has token charges without an extra platform per-call fee; a remote provider can have its own terms.^[33] Speech audio is metered for audio sent or received; function results and audio input events are excluded from the separate text-event meter.^[36]

Announced change: September 21, 2026 at noon Pacific, X Search changes to $5 per 1,000 posts fetched and $10 per 1,000 user profiles fetched. Parent and quoted posts count. That is a material change from billing by call.^[33]

Image/video model, quality, duration, and edit inputs also affect costs. Priority processing carries a 2× token multiplier; the US endpoint adds its documented premium.^[33][25][29]

Plans and licenses

Grok Business lists $30 per user per month, with Enterprise sold through a custom agreement. The business page advertises no training on business data and administrative capabilities; Enterprise adds controls such as SSO/SCIM and more configurable deployment arrangements. Confirm which tier supplies the required control rather than borrowing a capability from the umbrella page.^[37]

Hosted API access is governed by service terms. Public weight releases have their own licenses: the Grok-1 repository applies Apache 2.0 to its released code and weights; Grok-2 uses the xAI Community License, including restrictions on using its materials to train or improve other foundation/general models. Neither license should be applied to hosted Grok 4.6 or all SpaceXAI products.^[38][39][40]

---

Competitive Positioning

Choose the layer before choosing a vendor. A model API, a coding harness, a personal agent with a computer, and a multi-provider hosting platform solve different portions of a system. Use agent frameworks to evaluate application orchestration, personal agent platforms for ongoing delegated work, and inference platforms for hosting and serving choices. SpaceXAI's model-lab identity alone does not make it a member of every one of those categories.

Where Tembo fits

Tembo is relevant as an operating layer for coding work. Its current platform describes isolated VM sessions, repository and issue context, automations, reviewable PR output, and cloud or self-hosted operation. It explicitly lists Grok Build and Cursor among supported agent harnesses. That creates concrete complementary context for a team deciding how to run and supervise coding agents across its own workflows.^[41]

The Grok API supplies models and managed tools; Tembo supplies an environment and workflow around coding execution. A team needing a speech endpoint or a document-search response should evaluate the API directly. A team coordinating repository tasks, recurring jobs, and review may also evaluate Tembo. The public harness listing does not establish feature parity, shared billing, or a specific Grok API/MCP integration contract.^[41]

Disclosure: Ry Walker is Tembo's CEO and co-founder.

Best and poor fits

Best fit: applications that can evaluate Grok on a defined workload, benefit from managed search or media/speech capabilities, and can implement the permissions and accounting around those capabilities.

Poor fit: applications whose requirements assume a persistent computer from the Python tool, approval enforcement through an unsupported MCP parameter, strict ZDR with a hosted retrieval corpus, or a regional guarantee covering every tool. Those requirements conflict with documented boundaries.^{[20][19][28][29]}

---

Viability and Unverified Claims

The reviewed evidence establishes a shipping product family, current developer documentation, recent model/media changes, and integration with Cursor. It does not establish independent uptime measurements, market share, or a durable quality lead. Evaluate commercial support and failure behavior alongside model output.^[1][26][3]

The May 2026 Anthropic announcement describes access to Colossus compute. It supports the existence of a bilateral capacity agreement, not a conclusion that Colossus is a generally available, self-service inference platform. The same announcement expresses interest in orbital compute; interest and infrastructure plans are not a deployed API feature.^[42]

“Starmind” and additional orbital-system specifications were not established as public developer offerings by the sources reviewed here. They remain watchlist items rather than capabilities, pricing entries, or recommendations.

The practical verdict is to evaluate SpaceXAI as a broad model-and-product supplier, then select the exact surface that fits the job. Its managed tools reduce work in the application, but also introduce execution, billing, retention, and visibility decisions that a successful pilot must test explicitly.

---

Research by Ry Walker Research • methodology