Data handling
What the API keeps about your requests, what it does not, and how to delete a key.
People send sensitive material through this API: malware samples, incident logs, red-team payloads, abuse reports. This page states plainly what happens to that material. It is short on purpose.
What we do not store
XField does not store API prompts or completions. The text you send and the text the model returns pass through to produce the response and are not kept afterward.
That covers every route: Chat Completions, Responses, Messages, and legacy completions, streamed or not. It also covers everything inside a request: system prompts, tool definitions, tool results, reasoning output, and image inputs.
What we do keep
Each request leaves a usage record. It contains:
| Field | Example |
|---|---|
| Model | glm-5.3-uncensored |
| Token counts | input, cached input, output |
| Timing | when the request ran and how long it took |
| Cost | what the request cost |
The record never contains the text of your prompt or the model's reply. Usage records are what billing is built on.
No training on your content
Your prompts and completions are not used to train or fine-tune models.
What this means for you
- Keep your own logs if you need them. If you want a history of what you asked and what came back, for an engagement report or an eval run, record it in your own system. There is no copy on our side to retrieve.
- There is nothing to delete after the fact. Because prompts and completions are not stored, there is no content to request removal of.
- Your client still matters. Coding agents, SDK wrappers, and observability tools on your side may log requests. Check their settings.
Deleting an API key
Keys are managed in Settings › API keys after you sign in.
- Find the key
Open Settings › API keys and pick the key you want to remove. The full key is only shown once, at creation, so it will not be visible here.
- Delete it
Delete the key from the list. Requests that still use it are rejected with a
401. - Rotate if needed
If the key was in use, create a new one, update
XFIELD_API_KEYwherever it is set, and redeploy. Do this before deleting the old key if you need zero downtime.
Delete a key straight away if it has been committed to a repository, pasted into a shared channel, or left on a machine you no longer control.
You can check which key a client is using with GET /api/v1/key:
curl https://xfield.cloud.brutal.ai/api/v1/key \
-H "Authorization: Bearer $XFIELD_API_KEY"Acceptable use
No added content filter does not mean no rules. Research, red-teaming, testing your own systems, fiction, and frank discussion are welcome. The full terms are in the acceptable use policy.