Change DM settings: POST /client/dm/settings/update

Docs

Change DM settings

Change who can message you, read receipts and call settings. Settings you leave out stay as they are.

POST/client/dm/settings/update

Your account, your proxy, your risk.

Account actions run with the session cookie of your own X account and go out through your own proxy. Use only accounts you control and follow X's rules. Automated posting, following or liking can get the account limited or suspended; that is between you and X. Treat the cookie like a password: it gives full access to the account. Trial keys cannot call these endpoints.

The API reads your current settings, applies the fields you send and saves the full set, like x.com does. Send at least one setting. No passcode needed.

Parameters

cookiebody · string · required
Cookie header of your own logged-in X session. Must contain auth_token, ct0 and twid (your account ID, set by x.com at login); guest_id is used when present.
proxybody · string · required
Your proxy, format http://user:pass@host:port. The requests to X go out through it. Used only for this request.
allow_dms_frombody · string · optional
Who can send you messages, X's value such as all or verified (/client/dm/settings shows your current one). Lower-case letters and underscore, up to 64 characters; X decides which values it accepts.
dm_receipt_settingsbody · string · optional
Read receipts, X's value (same format as allow_dms_from).
always_allow_dms_from_subscribersbody · boolean · optional
Always accept messages from your subscribers.
av_calls_enabledbody · boolean · optional
Allow audio and video calls.
accept_calls_from_everyonebody · boolean · optional
Accept calls from everyone.
accept_calls_from_followingbody · boolean · optional
Accept calls from people you follow.
accept_calls_from_verifiedbody · boolean · optional
Accept calls from verified users.
accept_calls_from_addressbookbody · boolean · optional
Accept calls from your contacts.

Name	In	Type	Required	Description
cookie	body	string	yes	Cookie header of your own logged-in X session. Must contain auth_token, ct0 and twid (your account ID, set by x.com at login); guest_id is used when present.
proxy	body	string	yes	Your proxy, format http://user:pass@host:port. The requests to X go out through it. Used only for this request.
allow_dms_from	body	string	no	Who can send you messages, X's value such as all or verified (/client/dm/settings shows your current one). Lower-case letters and underscore, up to 64 characters; X decides which values it accepts.
dm_receipt_settings	body	string	no	Read receipts, X's value (same format as allow_dms_from).
always_allow_dms_from_subscribers	body	boolean	no	Always accept messages from your subscribers.
av_calls_enabled	body	boolean	no	Allow audio and video calls.
accept_calls_from_everyone	body	boolean	no	Accept calls from everyone.
accept_calls_from_following	body	boolean	no	Accept calls from people you follow.
accept_calls_from_verified	body	boolean	no	Accept calls from verified users.
accept_calls_from_addressbook	body	boolean	no	Accept calls from your contacts.

Body parameters are sent as a JSON object with Content-Type: application/json.

Example request

curl -X POST 'https://api.twittrapi.com/client/dm/settings/update' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"cookie":"auth_token=...; ct0=...; twid=u%3D...","proxy":"http://user:pass@host:port","allow_dms_from":"verified","av_calls_enabled":false}'

import httpx

resp = httpx.post(
    "https://api.twittrapi.com/client/dm/settings/update",
    headers={"X-API-KEY": "YOUR_API_KEY"},
    json={
        "cookie": "auth_token=...; ct0=...; twid=u%3D...",
        "proxy": "http://user:pass@host:port",
        "allow_dms_from": "verified",
        "av_calls_enabled": False,
    },
    timeout=60,
)
print(resp.status_code, resp.json())

const resp = await fetch("https://api.twittrapi.com/client/dm/settings/update", {
  method: "POST",
  headers: { "X-API-KEY": process.env.TWITTRAPI_API_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({
    cookie: "auth_token=...; ct0=...; twid=u%3D...",
    proxy: "http://user:pass@host:port",
    allow_dms_from: "verified",
    av_calls_enabled: false,
  }),
});
console.log(resp.status, await resp.json());

Base URL https://api.twittrapi.com, key in the X-API-KEY header. The SDKs do not wrap account actions, so the examples are plain HTTP calls.

Response

Your DM settings after the change, like /client/dm/settings.

Simple format (?format=simple or X-Response-Format: simple): {data: {allowDmsFrom, readReceipts, qualityFilter, calls: {enabled, fromEveryone, fromFollowing, fromVerified, fromAddressBook}}}. Schema.

Example response coming soon.

In the raw format, field names and nesting come from X and can change without notice. See Response format; the simple format keeps a fixed schema.

Errors

400The body is not valid JSON.
422cookie or proxy is missing, the cookie has no twid or ct0, or the passcode is neither a string nor a whole number or longer than 64 characters. No setting is sent, a string setting is empty, too long or has other characters than lower-case letters and underscore, or a boolean setting is not true or false. Also: the account is suspended, or X rejected the session ("Twitter temporarily rejected this session; refresh the login and try again").
407The proxy is unreachable or timed out.
502X returned no DM settings. Refunded.
429X's rate limit for this account: "X rate limit reached for this account, try again later".
X'sX refused the request: answered with X's status and {"error": "X refused the request: <X's reason>"}. When X answers 200 with an error, the status is 422.

Errors every endpoint can return (401, 402, 403, 404, 408, 409, 429, 5xx), and which of them are charged, are on the Errors page. Calls that fail with 400, 408, 409 or a 5xx error are refunded.