X Undocumented API

Overview

Use this skill for X.com's frontend web API: GraphQL operations under https://x.com/i/api/graphql, supporting REST-like web endpoints under https://x.com/i/api, and the browser headers/cookies those calls require.

First Rules

• Verify operation names and query IDs against the current X web bundle; query IDs rotate.
• Treat operationName as the durable conceptual endpoint, and queryId as rotating bundle metadata.
• Never print raw cookies, auth_token, ct0, bearer tokens, proxy credentials, or full upstream payloads.
• Generate x-client-transaction-id from the current X web page/bundle material and the exact request method/path.
• Do not test mutations against live accounts unless the user explicitly asks for that mutation and understands the effect.
• Keep endpoint evidence with exact dates, operation IDs, variables, feature flags, response paths, account/access scope, and result counts.
• Separate upstream variables from local caller filters. A runtime or CLI itemFilter can be an application-side filter rather than a proven GraphQL variable.

Reference Map

Read only what the task needs: