TwittrAPI
Docs
Account actions

Account actions

Endpoints that read or change your own X account: post, reply, like, retweet, follow, bookmarks, media upload, profile, communities and direct messages.

Your account, your proxy, your risk.

Account actions run with the session cookie of your own X account and go out through your own proxy. Use only accounts you control and follow X's rules. Automated posting, following or liking can get the account limited or suspended; that is between you and X. Treat the cookie like a password: it gives full access to the account. Trial keys cannot call these endpoints.

How they work

  • All are POST requests with a JSON body. Your TwittrAPI key goes in the X-API-KEY header as usual.
  • cookie is the cookie header of your logged-in X session. It must contain auth_token and ct0. Copy it from your browser's developer tools while logged in to x.com.
  • proxy is required on every call, in the form http://user:pass@host:port. The request to X goes out through it, so X sees your proxy's IP, not ours. Use one proxy per account and keep it stable.
  • There is no login endpoint. Log in on x.com yourself and pass the cookie.
  • Most endpoints answer with {"status_code": ..., "response": "..."}, where response is X's body as a string. The HTTP status is X's status when X answered with an error, so a failed action is a failed request.
  • Add ?format=simple (or the header X-Response-Format: simple) to get the result as compact JSON in the simple format instead: the new tweet, the user, the media ID or {"data": {"success": true}}. Each endpoint page says what it returns. /premium/analyticsOverview has no simple format.
  • These calls are never retried by the gateway, because a retry could post or like twice. Each call is billed once; 400, 408 and 5xx are refunded like everywhere else, while 407 (proxy problem), 422 and X's own 4xx are charged. Details: Errors.

Endpoints

Direct messages

Read and send direct messages of your own X account, with the same cookie and proxy as the other account actions. Direct messages on X are end-to-end encrypted (X Chat).

To read or send messages, the API also needs your X Chat passcode. It unlocks your account's chat keys; messages are then decrypted and encrypted on our server while your request runs. The API does not store messages or the passcode. Listing conversations, reading a conversation's settings and your DM settings work without a passcode.

Each call is one billed call like the other account actions. The answers are JSON built by the API (not the {status_code, response} wrapper); format=simple returns the same data in the simple format.