Until December 31, 2026

Older endpoints

/api/stories, /api/profile, /api/highlights, /api/media, /api/download, /api/posts and /api/tiktok/analytics keep working for calls with an API key until December 31, 2026. Until then such a call gets the headers Deprecation, Sunset and Link. After that date they stop answering: a call with a key gets 410 with the code legacy_endpoint. New work should use /api/v1/. The tracker and analytics endpoints do not end; they are listed below.

Get 100 free requests Read the docs

Older endpoint to v1 endpoint

Each older endpoint, and the v1 endpoint to call instead. The page of a v1 endpoint has its parameters, a sample answer and code.

Older endpoint	Use instead	What changes
`POST /api/stories`	GET /v1/user/stories	It returned stories, highlights and the profile in one call. In v1 each is its own call: GET /v1/user/highlights and GET /v1/user/profile. You pay for each call you make.
`GET /api/profile`	GET /v1/user/profile	The same data in v1's field names, such as `full_name`, `is_private`, `profile_pic_url` and `external_url`.
`GET /api/highlights`	GET /v1/highlight	Send the `id` of the highlight, or its link as `url`.
`POST /api/media`	GET /v1/post	Send `url`, `code` or `id` in the query string. It is a `GET`.
`GET /api/download`	No replacement	A v1 answer carries the media links itself. Download the file from the link in your own code.
`GET /api/posts`	GET /v1/user/posts	The posts of an account, a page at a time, in v1's field names. Pass `next_cursor` back as `cursor` for the next page.
`GET /api/tiktok/analytics/:username`	No replacement	v1 has no TikTok endpoint.
`GET /api/tiktok/analytics/:username/export`	No replacement	v1 has no TikTok endpoint.

What a call with a key gets

Until December 31, 2026 the answer is the same as before, with three headers added: Deprecation, Sunset and Link.
Deprecation is the day v1 started, October 20, 2026, as a Unix time. Sunset is the end of December 31, 2026 in UTC, as an HTTP date. Link points to this page, with rel="deprecation".
After December 31, 2026 a call with an API key to these endpoints is answered 410 with { error, code }, where code is legacy_endpoint. It is not charged.
A call without a key, such as one from our own website, is not affected.

What stays

/api/tracker, /api/tracker/accounts, /api/tracker/quota, /api/tracker/precheck, /api/analytics/shadowban and /api/analytics/outbound keep working and do not end on December 31, 2026.

They are not part of API v1 and have no v1 endpoint. They belong to the plans of the website, not to the prepaid balance: Basic and Pro include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Each section below says how to sign in, what to send, what comes back and who may call.

GET /api/tracker/accounts

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: None.
Returns: {accounts}: each tracked account with its id, igUsername, the counts it started with (initialFollowers, initialFollowing), what it tracks (storyOnly, trackFollows, trackFollowers, trackStories), syncStatus, lastPolledAt and createdAt.
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

POST /api/tracker/accounts

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: A JSON body with igUsername (required), mode (full or lock, full when left out) and replaceAccountId (the id of a tracked account to put under the lock to make room, not together with lock).
Returns: The added account, in the shape of the list above; its first reading runs in the background. A refused add (no free slot, the day's or the month's adds used up) answers 403 or 429 with error, code and limit.
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

DELETE /api/tracker/accounts

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: accountId, the id of a tracked account, in the query string or in a JSON body.
Returns: {success: true}, or 404 when there is no such account.
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

GET /api/tracker

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: page (1 to 100, 1 when left out) and limit (20 to 500, 200 when left out), in the query string.
Returns: {accounts, activities, total, page, pages}: your tracked accounts and one page of their changes, newest first. A change has its activityType (such as FOLLOWER_ADDED, FOLLOWER_REMOVED, FOLLOW and UNFOLLOW), the account and the moment it was seen in detectedAt.
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

GET /api/tracker/quota

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: None.
Returns: How much of the plan's lists you use: followingUsed and followingTotal, followersUsed and followersTotal, accountsUsed and accountsTotal, byAccount, the plan in tier and the export rows used. An answer may be up to 5 minutes old (the header X-Cache: HIT says so).
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

POST /api/tracker/precheck

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: A JSON body with igUsername (required).
Returns: {canAdd, allocation, profile, warning, anyPlanCountOnly}: how many followers and following the plan would read by name for the account (allocation), the account's own counts (profile) and a warning: none when only story alerts fit, partial when part of a list would come as a count with no names, else null. An account that does not exist answers 404, a private one or one with more followers than the plan takes answers 400, and a refused add answers 403 or 429.
Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is 403. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers 429.

GET /api/analytics/shadowban

Auth: Send Authorization: Bearer <token> or the X-Api-Key header. A missing or wrong credential answers 401.
Parameters: username (required) and locale (optional, the language of the recommendations), in the query string.
Returns: {username, score, verdict, signals, checkedAt, recommendations}: a score from 0 to 100, a verdict (clean, possibly_limited or likely_shadowbanned), the signals behind it, each with a status of ok, warning or critical, and what to do about it in recommendations. An account that does not exist or is private answers 404.
Who can use it: Any signed-in user, with a Bearer token or an API key. Each call counts toward the daily analysis allowance of the website plan (Free: none, Basic: 10 a day, Pro: unlimited), and a call over it answers 429.

GET /api/analytics/outbound

Auth: Send Authorization: Bearer <token> only. This endpoint does not read X-Api-Key. A missing or wrong token answers 401.
Parameters: username (a tracked account, required) and days (1 to 90, 30 when left out), in the query string.
Returns: {username, days, totalLikes, totalComments, topTargets, recentActivity}: the likes and comments the tracked account left on other accounts' posts, the accounts it interacts with most and the latest of its interactions.
Who can use it: A Pro subscription and the Deep Analytics add-on on the account you ask about, which must be tracked with full tracking, not as a story alert. Without Pro or the add-on the answer is 403, and an account you do not track answers 404.

Moving to v1

v1 takes the key in the X-Api-Key header, and only there.
An older key works on v1 once the account behind it is linked to Telegram. Until then v1 answers telegram_required with a link to do it.
v1 is paid from a prepaid balance instead of a daily quota, and a new account starts with 100 free requests. See pricing.
Every v1 endpoint is a GET with its parameters in the query string. The docs list them all.

Your first 100 requests are on us

Get my API key Read the docs