kernelpanic0x11 / instagram-api-workbench

# Instagram API Workbench
Browse the hosted Swagger catalog at ig.beehivewebstudio.com/swagger.html. The existing bio site address remains available. Authentication and execution run in the local workbench.
A local JavaScript Swagger UI and an evidence-linked reconstruction of Instagram's Android API surface. Built from static analysis of Instagram Android **451.0.0.53.80**, using REA, JADX, and custom DEX analysis scripts.
**679 HTTP operations · 1,456 normalized paths · 777 unresolved-method route candidates**
These counts describe recovered client configuration, **not endpoints verified to work against Instagram**. The project does not contain Instagram's server code, ranking algorithm, or a proven way to increase reach.
## Run
Install Node.js 20.11 or later, then:
 [code] 
Open **http://127.0.0.1:8766/**. Runtime dependencies and Swagger assets are already included; no npm install is required to browse or run the local server.
Everything is on that page:
- Standard Swagger UI with expandable operations and **Try it out**.
- An in-memory connection panel for an existing session cookie or bearer token.
- A manual GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS editor.
- Unresolved routes, GraphQL operation-name candidates, Bloks identifiers, and source evidence.
The JavaScript proxy forwards explicit requests to the connected profile: `https://www.instagram.com` for browser cookies or `https://i.instagram.com` for Android sessions. Relative routes default to `/api/v1`; explicit `api/`, `graphql`, and `rupload_` prefixes are preserved. This is a client routing choice, not a verified host/base-path binding for every candidate.
For browser login, install the optional helper once with `cd api && npm ci`, keep Google Chrome installed, and click **Open Instagram login** in Swagger. Sign in directly on Instagram in the separate Chrome window, then click **Verify authentication** and **GET my account settings**. Requests execute in that browser context; the workbench does not export cookies or save a browser storage-state file. Disconnect closes the temporary session. Advanced manual cookie/bearer entry remains available. Login challenges must be completed directly on Instagram. This is local browser automation, not Meta OAuth or a third-party login service.
**Connect & verify** verifies Browser sessions through the private `GET /api/v1/accounts/edit/web_form_data/` endpoint, returning only the authenticated username. Android sessions use `GET /api/v1/accounts/current_user/?edit=true`, including numeric account-ID matching when an expected ID is available. Browser verification cannot compare numeric IDs. A live Browser verification succeeded during development. Verification applies at the recorded time and does not prove permissions for every endpoint. Some operations need app headers, device context, signed payloads, or challenge completion. Mutating requests can change your account when executed.
### Finding your own session cookie
Log into Instagra