Through OrcaRouter the OrcaCyber Ultra 1.0 API is the narrowest interface in the family and the most expensive: text in, text out, no images, no audio, no video, at $5.00 in and $10.00 out per million [OURS]. What it offers instead is a 1,048,576-token context, a 131,072-token output ceiling, native function calling, JSON output, a separable reasoning mode and a zero-data-retention option.
That combination describes a specific kind of client: one that has already converted its evidence to text and wants a large, careful, machine-readable answer.
The request
Standard chat completions, so any OpenAI-compatible client works by pointing the base URL at the gateway. Three capabilities matter:
Tools. Define functions; the model emits calls. The same array shape as everywhere else on the key.
JSON. Response format with a schema. For a pipeline that consumes findings, this is the integration point.
Reasoning mode. The model’s working can be returned separately from the answer, and disabled per request.
The last one is the flagship’s distinguishing feature inside the API surface. A model that shows its reasoning and lets you turn it off gives a pipeline two modes — a thorough one and a fast one — from one endpoint.
Why text-only is not a limitation here
It reads like a downgrade next to siblings that accept audio and video, and for some workloads it is. For this card’s stated purpose it is a design decision with a reason.
Large-codebase scanning, cross-file vulnerability discovery, exploit-chain analysis and forensics over audit reports and log streams are all text problems once the evidence is assembled. An image path would add token cost and encoder complexity to a card whose value is depth over a very large context.
The card’s job is to read a million tokens carefully and emit a structured artifact. Every modality that does not serve that job is overhead.
What a request looks like at the limits
Fill it: 1,048,576 input tokens and 131,072 output.
Cost: 1.048576 × $5.00 + 0.131072 × $10.00 = $5.24 + $1.31 = $6.55 [OURS].
That is the maximum single request the card accepts, and it is a useful anchor: six and a half dollars for a whole-repository read plus a maximum-length report. Nothing about that number is prohibitive for an incident; everything about it argues for getting the scoping right before sending.
At a more typical shape — 300,000 input and 20,000 output — the cost is $1.70.
The output contract
The ceiling of 131,072 tokens is generous for a structured artifact and modest for a narrative one.
A findings set with a schema fits comfortably: twenty findings with evidence, severity, file, line and remediation, each a few hundred tokens, is well under twenty thousand. A narrative report of the same findings is longer and less useful downstream.
The card’s interface pushes you toward structure, which is the right direction for anything that feeds another system.
Where the interface gets in the way
Three friction points, all real.
No image input. A screenshot of an error dialog has to be described in text first — an OCR step you would not need on a sibling.
No audio or video. Same problem, larger.
Latency at the ceiling. The card’s measured throughput is 42.2 tokens per second, so a maximum-length answer takes about fifty-two minutes to emit [OURS]. The interface accepts the request; the clock is what makes it a batch job.
None of these is a defect. Each is a reason to route media and interactive work elsewhere.
The access gate
As with every OrcaCyber card, the endpoint requires an engagement, a passkey and acceptance of the terms before it serves a request [OURS]. For a card aimed at incident response, that gate is a procurement step with a calendar — start it before the engagement, not during it.
What the contract does not specify
Reliability, for one. The card’s error rate over the measured week is 0.295%, which is a real figure from real traffic — six billion tokens of it — but it is not a guarantee, and a single week is a snapshot [OURS].
Quality, for another. The page publishes no benchmark rows at all, so the contract describes what the endpoint accepts and returns, not how well it does either.
That is the honest summary of the interface: well defined, well provisioned, and unmeasured on the dimension most buyers care about.
Sizing the first request
A contract is easier to trust after one real request, and the first one should be deliberately conservative.
Send 50,000 tokens of a repository you know, ask for a 2,000-token structured summary with a schema, and check three things: that the response validates, that the file references are correct, and that the duration matches the published throughput. At 42.2 tokens per second, 2,000 output tokens should take about 47 seconds.
That single request tells you whether the interface behaves as documented, whether the schema is being honoured, and whether your client’s timeout is set correctly — before you have spent anything on a real audit.
Then scale: 200,000 tokens, 10,000 out, same checks. Two requests, about two dollars, and the contract is verified rather than assumed.
The second request is the interesting one
The first request tests the interface. The second tests the model.
Use the same evidence and ask a question whose answer you know. Whether the model finds it, and whether the reasoning it shows is sound, is the only quality signal available on a card that publishes no benchmark rows [OURS].
If the answer is right and the reasoning is visible, you have evidence. If the answer is right and the reasoning is not visible, you have a coincidence.
The takeaway
Text in, structured text out, a million tokens of context, a 131,072 ceiling and a separable reasoning mode, at five and ten dollars per million. The interface is narrow by design and expensive by design.
Choose it for the jobs that need a whole corpus in one pass and a parseable answer — and keep the media work on a card that accepts media. Two requests on your own evidence will confirm the contract before any of that matters.
The contract is small enough to hold in your head: one input type, one output type, two budgets, three capabilities. Everything else about the card is a consequence of those.
Also read: Top 10 All-in-One AI Image Platforms That Bundle Multiple Models in 2026
Sourcing note: capabilities, modalities, context window, output ceiling, pricing and the access gate are from the OrcaRouter model page, checked 2026-10-27 [OURS]. Throughput and error rate are OrcaRouter production telemetry for the seven days ending 2026-10-26 [OURS]. No benchmark figures are stated, because the model page publishes none.
