endpoints.yaml

# X internal endpoint map.
#
# Captured from the live x.com web client. X rotates these query IDs
# whenever they ship a new web bundle. When a call starts returning 404
# or a "feature error", update this file (or drop a fresh copy at
# ~/.config/x-cli/endpoints.yaml) — no rebuild required.
#
# Last refresh: 2026-04-13, captured directly from the logged-in web
# client via Chrome MCP (Network panel walk over /jack, /jack/following,
# /jack/verified_followers, /search?q=golang, and a tweet detail page).
#
# References:
#   - d60/twikit (MIT) — twikit/client/gql.py
#   - the-convocation/twitter-scraper (MIT) — src/api-data.ts
#
# This file is data, not code, on purpose. You can ship updates without
# a rebuild by replacing it at ~/.config/x-cli/endpoints.yaml.

bases:
  graphql: https://x.com/i/api/graphql
  rest: https://x.com/i/api
  api: https://api.x.com

# Public bearer token embedded in X's web bundle. Same token used by
# twikit and twitter-scraper. Rotate if X revokes it.
bearer: "AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA"

# Default GraphQL features blob — the "timeline" set captured from
# Followers/Following/SearchTimeline/UserTweets/BlueVerifiedFollowers
# requests in the live web client. Profile-page ops (UserByScreenName,
# UserByRestId) use their own override under the per-op features key
# because they need a different set (see below).
#
# Profile-only keys NOT included here:
#   hidden_profile_subscriptions_enabled
#   subscriptions_verification_info_is_identity_verified_enabled
#   subscriptions_verification_info_verified_since_enabled
#   highlights_tweets_tab_ui_enabled
#   responsive_web_twitter_article_notes_tab_enabled
#   subscriptions_feature_can_gift_premium
#
# Adding them here breaks Followers/SearchTimeline (the gateway returns
# 404 with empty body when an op receives features it doesn't expect).
features:
  rweb_video_screen_enabled: false
  profile_label_improvements_pcf_label_in_post_enabled: true
  responsive_web_profile_redirect_enabled: false
  rweb_tipjar_consumption_enabled: false
  verified_phone_label_enabled: false
  creator_subscriptions_tweet_preview_api_enabled: true
  responsive_web_graphql_timeline_navigation_enabled: true
  responsive_web_graphql_skip_user_profile_image_extensions_enabled: false
  premium_content_api_read_enabled: false
  communities_web_enable_tweet_community_results_fetch: true
  c9s_tweet_anatomy_moderator_badge_enabled: true
  responsive_web_grok_analyze_button_fetch_trends_enabled: false
  responsive_web_grok_analyze_post_followups_enabled: true
  responsive_web_jetfuel_frame: true
  responsive_web_grok_share_attachment_enabled: true
  responsive_web_grok_annotations_enabled: true
  articles_preview_enabled: true
  responsive_web_edit_tweet_api_enabled: true
  graphql_is_translatable_rweb_tweet_is_translatable_enabled: true
  view_counts_everywhere_api_enabled: true
  longform_notetweets_consumption_enabled: true
  responsive_web_twitter_article_tweet_consumption_enabled: true
  content_disclosure_indicator_enabled: true
  content_disclosure_ai_generated_indicator_enabled: true
  responsive_web_grok_show_grok_translated_post: true
  responsive_web_grok_analysis_button_from_backend: true
  post_ctas_fetch_enabled: true
  freedom_of_speech_not_reach_fetch_enabled: true
  standardized_nudges_misinfo: true
  tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled: true
  longform_notetweets_rich_text_read_enabled: true
  longform_notetweets_inline_media_enabled: false
  responsive_web_grok_image_annotation_enabled: true
  responsive_web_grok_imagine_annotation_enabled: true
  responsive_web_grok_community_note_auto_translation_is_enabled: true
  responsive_web_enhance_cards_enabled: false

# GraphQL queries and mutations.
#
# budget fields:
#   rps:    steady-state requests per second (read)
#   burst:  token bucket burst size
#   kind:   read | mutation
graphql:
  UserByScreenName:
    queryId: IGgvgiOx4QZndDHuD3x9TQ
    operationName: UserByScreenName
    kind: read
    rps: 0.5
    burst: 2
    # Profile-specific features blob. Different from the global
    # "timeline" set: includes hidden_profile_subscriptions and
    # subscriptions_verification_info_* which the timeline ops
    # reject as unknown.
    features:
      hidden_profile_subscriptions_enabled: true
      profile_label_improvements_pcf_label_in_post_enabled: true
      responsive_web_profile_redirect_enabled: false
      rweb_tipjar_consumption_enabled: false
      verified_phone_label_enabled: false
      subscriptions_verification_info_is_identity_verified_enabled: true
      subscriptions_verification_info_verified_since_enabled: true
      highlights_tweets_tab_ui_enabled: true
      responsive_web_twitter_article_notes_tab_enabled: true
      subscriptions_feature_can_gift_premium: true
      creator_subscriptions_tweet_preview_api_enabled: true
      responsive_web_graphql_skip_user_profile_image_extensions_enabled: false
      responsive_web_graphql_timeline_navigation_enabled: true
  UserByRestId:
    queryId: VQfQ9wwYdk6j_u2O4vt64Q
    operationName: UserByRestId
    kind: read
    rps: 0.5
    burst: 2
  UserTweets:
    queryId: x3B_xLqC0yZawOB7WQhaVQ
    operationName: UserTweets
    kind: read
    rps: 0.3
    burst: 2
  UserTweetsAndReplies:
    queryId: vMkJyzx1wdmvOeeNG0n6Wg
    operationName: UserTweetsAndReplies
    kind: read
    rps: 0.3
    burst: 2
  UserMedia:
    queryId: 2tLOJWwGuCTytDrGBg8VwQ
    operationName: UserMedia
    kind: read
    rps: 0.3
    burst: 2
  TweetDetail:
    queryId: rU08O-YiXdr0IZfE7qaUMg
    operationName: TweetDetail
    kind: read
    rps: 0.5
    burst: 2
  TweetResultByRestId:
    queryId: Xl5pC_lBk_gcO2ItU39DQw
    operationName: TweetResultByRestId
    kind: read
    rps: 0.5
    burst: 2
  SearchTimeline:
    queryId: pCd62NDD9dlCDgEGgEVHMg
    operationName: SearchTimeline
    kind: read
    rps: 0.3
    burst: 2
  Followers:
    queryId: "-WcGoRt8IQuPm-l1ymgy6g"
    operationName: Followers
    kind: read
    rps: 0.2
    burst: 1
  BlueVerifiedFollowers:
    queryId: wlnE16ojgADYiHEqMzR3sw
    operationName: BlueVerifiedFollowers
    kind: read
    rps: 0.2
    burst: 1
  Following:
    queryId: vWCjN9gcTJiXzzMPR5Oxzw
    operationName: Following
    kind: read
    rps: 0.2
    burst: 1
  Favoriters:
    queryId: LLkw5EcVutJL6y-2gkz22A
    operationName: Favoriters
    kind: read
    rps: 0.2
    burst: 1
  Retweeters:
    queryId: X-XEqG5qHQSAwmvy00xfyQ
    operationName: Retweeters
    kind: read
    rps: 0.2
    burst: 1

  # GraphQL mutations — engagement actions. Query IDs cross-referenced
  # from twikit and twitter-scraper. Marked as `mutation` so a future
  # commit can route them through the per-mutation throttle (today
  # they go through the read bucket via Client.graphqlMutation).
  FavoriteTweet:
    queryId: lI07N6Otwv1PhnEgXILM7A
    operationName: FavoriteTweet
    kind: mutation
    rps: 0.1
    burst: 1
  UnfavoriteTweet:
    queryId: ZYKSe-w7KEslx3JhSIk5LA
    operationName: UnfavoriteTweet
    kind: mutation
    rps: 0.1
    burst: 1
  CreateRetweet:
    queryId: ojPdsZsimiJrUGLR1sjUtA
    operationName: CreateRetweet
    kind: mutation
    rps: 0.1
    burst: 1
  DeleteRetweet:
    queryId: iQtK4dl5hBmXewYZuEOKVw
    operationName: DeleteRetweet
    kind: mutation
    rps: 0.1
    burst: 1
  CreateBookmark:
    queryId: aoDbu3RHznuiSkQ9aNM67Q
    operationName: CreateBookmark
    kind: mutation
    rps: 0.1
    burst: 1
  DeleteBookmark:
    queryId: Wlmlj2-xzyS1GN3a6cj-mQ
    operationName: DeleteBookmark
    kind: mutation
    rps: 0.1
    burst: 1

# REST v1.1 endpoints used for follow/unfollow.
#
# NOTE: /1.1/account/verify_credentials.json was removed sometime
# before April 2026. x-cli now uses UserByRestId (above) with the
# `twid` cookie for the auth liveness check — see api/auth.go
# VerifyCredentials.
rest:
  friendshipsCreate:
    path: /1.1/friendships/create.json
    method: POST
    kind: mutation
    min_gap: 8s
    max_gap: 22s
    daily_cap: 200
  friendshipsDestroy:
    path: /1.1/friendships/destroy.json
    method: POST
    kind: mutation
    min_gap: 8s
    max_gap: 22s
    daily_cap: 200