Best OSINT APIs for Twitter/X in 2026

A suspicious account turns up in a phishing campaign. You need four things: its posting history, the accounts that amplified it, whether it changed its handle last month, and proof of a post it deleted an hour ago. Each of those questions needs a different data source on X, and most teams only learn which source they need after the investigation has started.

Introduction

The right twitter osint api depends on the job. The official X API has the deepest archive, reaching back to March 2006, and the only first-party way to check whether a post was deleted. Low-cost third-party APIs are the cheapest option for bulk pulls. Investigator platforms resolve identities across networks. Agent-native tools like Xpoz let an AI assistant run X queries and pivot to other platforms in one session.

Most "Twitter API" comparisons are written for app developers who care about SDK quality and uptime. OSINT, threat intelligence and trust & safety teams need different things. They need deep history, network context, evidence that survives deletion, and a clear view of the legal terms. This guide scores the main X OSINT tools against those investigation needs and ends with a matrix of which tool fits which job.

Why X Data Is Harder for Investigators in 2026

Getting X data for investigations now costs more and carries more rules. The official API charges for every post and user you read, caps monthly volume, and its Developer Agreement restricts intelligence gathering. Teams that once pulled data freely now have to plan for budget, rate limits and legal review before they collect anything.

The official pricing is pay-per-usage with no subscriptions:

Posts and users are deduplicated within a 24-hour UTC day, so fetching the same post again that day is not billed a second time. X calls this a "soft guarantee".

Rate limits shape the work just as much as price. Full-archive search allows 1 request per second and 300 requests per 15 minutes per app. Recent search allows 450 per 15 minutes, and follower and following lookups allow 300 per 15 minutes. Investigations tend to come in bursts and go deep on a few targets, so these limits are hit more often than the monthly cap.

Five Criteria That Matter for OSINT

Five criteria matter most when you evaluate a twitter osint api for investigations: how far back you can search, how well you can map networks, what happens to deleted content, what the terms of use allow, and what it costs at investigation scale. Developer-focused reviews usually leave out the last three.

The Official X API: Deepest Archive, Tightest Rules

The official X API is the only source with first-party full-archive search back to March 2006, along with tweet counts and a compliance endpoint that reports deletions. It is also the most restrictive option for intelligence work. The Developer Agreement bars surveillance and intelligence gathering unless X approves it in writing.

What you get

Full-Archive Search is open to pay-per-use and Enterprise customers. It returns up to 500 posts per request and accepts queries up to 1,024 characters (4,096 on Enterprise). Recent Search covers only the last 7 days. Follower and following endpoints support twitter follower network analysis, and the counts endpoints let you size a topic before you pay to read the posts.

The intelligence-use clause

Most comparisons skip this part. The Developer Agreement restricts three things:

• XIV.B(a) bars "conducting or providing surveillance or gathering intelligence" without X's written approval.
• XIV.B(c) bars monitoring sensitive events, including protests and rallies.
• XIV.C bars providing X content to government end users whose mission includes surveillance or intelligence gathering. Government end users require Enterprise.

The Developer Policy adds two more obligations. You must delete or modify stored content within 24 hours when it is deleted or modified on X, and you may not store, aggregate or cache location data. For a threat-intel team, the first rule works directly against evidence preservation.

X API pricing 2026 at investigation scale

As an example, take a case that needs 50,000 archived posts and 20,000 follower profiles. At list prices that comes to $250 for the posts and $200 for the profiles, before any repeat pulls on later days.

Low-Cost Data APIs: TwitterAPI.io, SocialData, Apify, Bright Data

Third-party X data APIs cost a fraction of the official per-post price, often under $1 per 1,000 tweets. That makes them practical for bulk collection and timeline pulls. The trade-off is provenance: they collect public data outside the official X API, and their standing under X's terms has not been verified.

Apify's scraper does not collect replies or conversation threads, so it is a poor fit when the evidence is in a reply chain. Rate limits for TwitterAPI.io and SocialData are not published on their pricing pages; test them before you depend on them mid-case.

Risk: none of these vendors should be treated as cleared for your use case. Get legal review before collected data goes into a report, a court filing or a government deliverable.

Investigator Platforms: Social Links, ShadowDragon, Maltego

Investigator platforms are built for identity resolution and link analysis rather than raw data pulls. They connect an X handle to aliases, other platforms and public records, and display the result as a graph. Annual licenses run from free to several thousand pounds or euros per seat.

Unverified: the vendor pages do not list exact X endpoints for SocialNet or the SL API, so ask for X-specific coverage before you buy.

Deleted Tweets OSINT: Proving a Post Existed

To prove a deleted tweet existed, you need either a capture made before it was deleted or a third-party archive. The X API can confirm that a post is gone but will not return its content, and its own terms require you to purge stored copies. Evidence preservation therefore takes more than one tool.

1. Check status with X Batch Compliance. Batch Compliance accepts post or user IDs and reports which ones were deleted, protected, deactivated, suspended or edited.
2. Query the Wayback Machine CDX API. It is free and needs no key for public data. It lists archived captures of a URL by date range:

http://web.archive.org/cdx/search/cdx?url=x.com/exampleuser/status/&matchType=prefix&from=20250101&to=20261020&filter=statuscode:200

1. Capture at collection time. Take screenshots with timestamps, save the raw API responses, and hash the files when you collect them. That chain of custody is what makes the evidence defensible later.

Edits are easier to handle than deletions. Several sources return edit history, so you can show what a post said before it changed.

How Xpoz Addresses This

Xpoz is a hosted MCP server and API that gives an AI assistant direct access to Twitter/X, Instagram, TikTok and Reddit. It draws on 3B+ indexed posts across Twitter, Instagram, TikTok, and Reddit, with no X developer account required. An analyst describes what they need, and the assistant chooses the tools, runs the queries and summarizes the results.

Here is how the Xpoz Twitter tools map to OSINT tasks:

Several fields matter specifically for investigations. User profiles include username-change history, accountBasedIn and the account creation date. Posts include edit history (originalTweetId, editedTweets), Community Notes text, and tagged-place location. The same session can also pivot to Instagram, TikTok and Reddit tools when a subject reuses a handle on another platform.

Pricing is per query, with no charge for the number of rows returned. An X query costs 2 credits, and fast mode returns up to 300 results per call. The free tier includes 500 one-time credits with no credit card, Pro is $20/month for 7,500 credits, and Max is $200/month for 120,000 credits (pricing).

Limits:

• Xpoz covers historical and recent data but does not guarantee a specific archive depth.
• Follower results can be partial; compare totalRows with totalDataCount.
• Country filtering on X search is Enterprise-only.
• Xpoz is an analysis layer, not an evidence vault. Pair it with Wayback captures and your own preservation workflow, and run your use case past legal review.

Practical Examples

Example 1: Mapping an impersonation network

A fraud team finds a fake support account. The analyst asks the assistant to find lookalike handles, profile them, and check which ones share followers.

{"tool": "searchTwitterUsers", "arguments": {"name": "AcmeBank Support", "limit": 10}}
{"tool": "getTwitterUsers", "arguments": {"identifiers": ["acmebank_help", "acmebanksupportt", "acme_bank_care"], "identifierType": "username"}}
{"tool": "getTwitterUserConnections", "arguments": {"username": "acmebank_help", "connectionType": "followers"}}

From the creation dates and username-change history, the analyst can see which accounts were renamed from unrelated handles shortly before the campaign began.

Example 2: Sizing a wallet-drainer campaign

A threat-intel analyst checks the volume of a scam phrase before spending credits on full pulls, then gets the posts and the accounts that boosted the top one.

{"tool": "countTweets", "arguments": {"phrase": "\"claim airdrop\" wallet", "startDate": "2026-09-01", "endDate": "2026-10-20"}}
{"tool": "getTwitterPostsByKeywords", "arguments": {"query": "\"claim airdrop\" AND (wallet OR connect)", "sortBy": "latest", "filterOutRetweets": true, "startDate": "2026-09-01", "endDate": "2026-10-20"}}
{"tool": "getTwitterPostInteractingUsers", "arguments": {"postId": "1846000000000000000", "interactionType": "retweeters"}}

The assistant groups the retweeters by account age and follower count, which separates organic sharers from a cluster of new accounts that arrived together.

Example 3: Cross-platform handle pivot

A trust & safety reviewer finds the same handle on X and Reddit. One prompt runs getTwitterPostsByAuthor and getRedditUser, then compares posting times and topics across both.

Which Tool for Which Investigation

Key Takeaways

• No single twitter osint api covers every investigation need. Choose by task: archive depth, network mapping, deletion evidence or cost.
• The official X API has the deepest archive, but clauses XIV.B and XIV.C of its Developer Agreement restrict intelligence and government use.
• Third-party APIs cut per-post costs by more than 95% compared with $0.005 per official post read, but their provenance needs legal review.
• Deleted tweets OSINT depends on capturing posts before they disappear. The Wayback CDX API and your own hashed captures carry that evidence.
• Xpoz lets an AI assistant run X searches, profile lookups and amplification analysis in one session, with per-query pricing and no X developer account.

Conclusion

Use more than one source. Use the official API when you need provenance and pre-2015 history, low-cost APIs for bulk collection, investigator platforms for identity resolution, and archives for evidence. Use an agent-native layer like Xpoz when you need to move from a lead to a mapped network quickly. Check every source's terms against your use case before you collect.

To test Xpoz on a live case, connect https://mcp.xpoz.ai/mcp to Claude, Cursor, ChatGPT or another MCP-compatible client at xpoz.ai. Setup instructions are at help.xpoz.ai. Start free with 500 credits.