# Older endpoints

`/api/stories`, `/api/profile`, `/api/highlights`, `/api/media`, `/api/download`, `/api/posts` and `/api/tiktok/analytics` keep working for calls with an API key until December 31, 2026. Until then such a call gets the headers `Deprecation`, `Sunset` and `Link`. After that date they stop answering: a call with a key gets `410` with the code `legacy_endpoint`. New work should use `/api/v1/`. The tracker and analytics endpoints do not end; they are listed below.

## Older endpoint to v1 endpoint

Each older endpoint, and the v1 endpoint to call instead. The page of a v1 endpoint has its parameters, a sample answer and code.

| Older endpoint | Use instead | What changes |
| --- | --- | --- |
| `POST /api/stories` | [GET /v1/user/stories](https://storiesfly.com/developers/docs/user-stories) | It returned stories, highlights and the profile in one call. In v1 each is its own call: [GET /v1/user/highlights](https://storiesfly.com/developers/docs/user-highlights) and [GET /v1/user/profile](https://storiesfly.com/developers/docs/user-profile). You pay for each call you make. |
| `GET /api/profile` | [GET /v1/user/profile](https://storiesfly.com/developers/docs/user-profile) | The same data in v1's field names, such as `full_name`, `is_private`, `profile_pic_url` and `external_url`. |
| `GET /api/highlights` | [GET /v1/highlight](https://storiesfly.com/developers/docs/highlight) | Send the `id` of the highlight, or its link as `url`. |
| `POST /api/media` | [GET /v1/post](https://storiesfly.com/developers/docs/post) | Send `url`, `code` or `id` in the query string. It is a `GET`. |
| `GET /api/download` | No replacement | A v1 answer carries the media links itself. Download the file from the link in your own code. |
| `GET /api/posts` | [GET /v1/user/posts](https://storiesfly.com/developers/docs/user-posts) | The posts of an account, a page at a time, in v1's field names. Pass `next_cursor` back as `cursor` for the next page. |
| `GET /api/tiktok/analytics/:username` | No replacement | v1 has no TikTok endpoint. |
| `GET /api/tiktok/analytics/:username/export` | No replacement | v1 has no TikTok endpoint. |

## What a call with a key gets

- Until December 31, 2026 the answer is the same as before, with three headers added: `Deprecation`, `Sunset` and `Link`.
- `Deprecation` is the day v1 started, October 20, 2026, as a Unix time. `Sunset` is the end of December 31, 2026 in UTC, as an HTTP date. `Link` points to this page, with `rel="deprecation"`.
- After December 31, 2026 a call with an API key to these endpoints is answered `410` with `{ error, code }`, where `code` is `legacy_endpoint`. It is not charged.
- A call without a key, such as one from our own website, is not affected.

## What stays

`/api/tracker`, `/api/tracker/accounts`, `/api/tracker/quota`, `/api/tracker/precheck`, `/api/analytics/shadowban` and `/api/analytics/outbound` keep working and do not end on December 31, 2026.

They are not part of API v1 and have no v1 endpoint. They belong to the plans of the website, not to the prepaid balance: Basic and Pro include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Each section below says how to sign in, what to send, what comes back and who may call.

## GET /api/tracker/accounts

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: None.
- Returns: `{accounts}`: each tracked account with its `id`, `igUsername`, the counts it started with (`initialFollowers`, `initialFollowing`), what it tracks (`storyOnly`, `trackFollows`, `trackFollowers`, `trackStories`), `syncStatus`, `lastPolledAt` and `createdAt`.
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## POST /api/tracker/accounts

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: A JSON body with `igUsername` (required), `mode` (`full` or `lock`, `full` when left out) and `replaceAccountId` (the `id` of a tracked account to put under the lock to make room, not together with `lock`).
- Returns: The added account, in the shape of the list above; its first reading runs in the background. A refused add (no free slot, the day's or the month's adds used up) answers `403` or `429` with `error`, `code` and `limit`.
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## DELETE /api/tracker/accounts

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: `accountId`, the `id` of a tracked account, in the query string or in a JSON body.
- Returns: `{success: true}`, or `404` when there is no such account.
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## GET /api/tracker

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: `page` (1 to 100, 1 when left out) and `limit` (20 to 500, 200 when left out), in the query string.
- Returns: `{accounts, activities, total, page, pages}`: your tracked accounts and one page of their changes, newest first. A change has its `activityType` (such as `FOLLOWER_ADDED`, `FOLLOWER_REMOVED`, `FOLLOW` and `UNFOLLOW`), the account and the moment it was seen in `detectedAt`.
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## GET /api/tracker/quota

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: None.
- Returns: How much of the plan's lists you use: `followingUsed` and `followingTotal`, `followersUsed` and `followersTotal`, `accountsUsed` and `accountsTotal`, `byAccount`, the plan in `tier` and the export rows used. An answer may be up to 5 minutes old (the header `X-Cache: HIT` says so).
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## POST /api/tracker/precheck

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: A JSON body with `igUsername` (required).
- Returns: `{canAdd, allocation, profile, warning, anyPlanCountOnly}`: how many followers and following the plan would read by name for the account (`allocation`), the account's own counts (`profile`) and a `warning`: `none` when only story alerts fit, `partial` when part of a list would come as a count with no names, else `null`. An account that does not exist answers `404`, a private one or one with more followers than the plan takes answers `400`, and a refused add answers `403` or `429`.
- Who can use it: Basic or Pro on the website, which include the tracker routes. Tracker API plans are no longer sold; a holder of one keeps access until the plan ends. Without access the answer is `403`. A call with an API key also counts toward the plan's daily limit for the tracker and a burst limit, and a call over either answers `429`.

## GET /api/analytics/shadowban

- Auth: Send `Authorization: Bearer <token>` or the `X-Api-Key` header. A missing or wrong credential answers `401`.
- Parameters: `username` (required) and `locale` (optional, the language of the recommendations), in the query string.
- Returns: `{username, score, verdict, signals, checkedAt, recommendations}`: a `score` from 0 to 100, a `verdict` (`clean`, `possibly_limited` or `likely_shadowbanned`), the `signals` behind it, each with a `status` of `ok`, `warning` or `critical`, and what to do about it in `recommendations`. An account that does not exist or is private answers `404`.
- Who can use it: Any signed-in user, with a Bearer token or an API key. Each call counts toward the daily analysis allowance of the website plan (Free: none, Basic: 10 a day, Pro: unlimited), and a call over it answers `429`.

## GET /api/analytics/outbound

- Auth: Send `Authorization: Bearer <token>` only. This endpoint does not read `X-Api-Key`. A missing or wrong token answers `401`.
- Parameters: `username` (a tracked account, required) and `days` (1 to 90, 30 when left out), in the query string.
- Returns: `{username, days, totalLikes, totalComments, topTargets, recentActivity}`: the likes and comments the tracked account left on other accounts' posts, the accounts it interacts with most and the latest of its interactions.
- Who can use it: A Pro subscription and the Deep Analytics add-on on the account you ask about, which must be tracked with full tracking, not as a story alert. Without Pro or the add-on the answer is `403`, and an account you do not track answers `404`.

## Moving to v1

- v1 takes the key in the `X-Api-Key` header, and only there.
- An older key works on v1 once the account behind it is linked to Telegram. Until then v1 answers `telegram_required` with a link to do it.
- v1 is paid from a prepaid balance instead of a daily quota, and a new account starts with 100 free requests. See [pricing](https://storiesfly.com/developers/pricing).
- Every v1 endpoint is a `GET` with its parameters in the query string. The [docs](https://storiesfly.com/developers/docs) list them all.

## Links

- [This page on the site](https://storiesfly.com/developers/docs/legacy)
- [Read the docs](https://storiesfly.com/developers/docs)
- [Instagram data API](https://storiesfly.com/developers): what the API is and what it returns
- [Pricing](https://storiesfly.com/developers/pricing): rates, examples and billing rules
- [OpenAPI file](https://storiesfly.com/openapi.json): the whole API in one file
- [API dashboard](https://storiesfly.com/developers/dashboard): get a key and top up
- [Changelog](https://storiesfly.com/developers/changelog): what changed and when