kernelpanic0x11/instagram-api-workbench

Browse the hosted Swagger catalog at ig.beehivewebstudio.com/swagger.html. The existing bio site address remains available. Authentication and execution run in the local workbench.

A local JavaScript Swagger UI and an evidence-linked reconstruction of Instagram's Android API surface. Built from static analysis of Instagram Android 451.0.0.53.80, using REA, JADX, and custom DEX analysis scripts.

679 HTTP operations · 1,456 normalized paths · 777 unresolved-method route candidates

These counts describe recovered client configuration, not endpoints verified to work against Instagram. The project does not contain Instagram's server code, ranking algorithm, or a proven way to increase reach.

Install Node.js 20.11 or later, then:

git clone https://github.com/kernelpanic0x11/instagram-api-workbench.git
cd instagram-api-workbench/api
node server.mjs

Open http://127.0.0.1:8766/. Runtime dependencies and Swagger assets are already included; no npm install is required to browse or run the local server.

Everything is on that page:

• Standard Swagger UI with expandable operations and Try it out.
• An in-memory connection panel for an existing session cookie or bearer token.
• A manual GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS editor.
• Unresolved routes, GraphQL operation-name candidates, Bloks identifiers, and source evidence.

The JavaScript proxy forwards explicit requests to the connected profile: https://www.instagram.com for browser cookies or https://i.instagram.com for Android sessions. Relative routes default to /api/v1; explicit api/, graphql, and rupload_ prefixes are preserved. This is a client routing choice, not a verified host/base-path binding for every candidate.

For browser login, install the optional helper once with cd api && npm ci, keep Google Chrome installed, and click Open Instagram login in Swagger. Sign in directly on Instagram in the separate Chrome window, then click Verify authentication and GET my account settings. Requests execute in that browser context; the workbench does not export cookies or save a browser storage-state file. Disconnect closes the temporary session. Advanced manual cookie/bearer entry remains available. Login challenges must be completed directly on Instagram. This is local browser automation, not Meta OAuth or a third-party login service.

Connect & verify verifies Browser sessions through the private GET /api/v1/accounts/edit/web_form_data/ endpoint, returning only the authenticated username. Android sessions use GET /api/v1/accounts/current_user/?edit=true, including numeric account-ID matching when an expected ID is available. Browser verification cannot compare numeric IDs. A live Browser verification succeeded during development. Verification applies at the recorded time and does not prove permissions for every endpoint. Some operations need app headers, device context, signed payloads, or challenge completion. Mutating requests can change your account when executed.

Log into Instagram in Chrome, open DevTools → Network, reload, and select an Instagram request. Copy its Cookie request header into the local connection panel. You can also inspect cookies under Application → Storage → Cookies (Chrome documentation). Preserve encoded values exactly. Leave Bearer token blank unless you already have one. Treat session credentials like a password; never share or commit them. A browser session may not work for every Android endpoint.

The research found a client-side recommendation-status display flow and publishing constraints. It did not recover a shadowban decision algorithm or a reliable distribution boost. Historical trace notes preserve what was known at each stage; the API method trace subsequently established GET for the nudge endpoint.

The indexed corpus contained 1,178,767 DEX strings. The bulk scanner decoded 807,462 methods across 23 DEX files with no decoder errors and recorded 826 same-receiver configuration observations, yielding 676 distinct method/path pairs. Individually traced operations bring the published total to 679.

The scanner resets at control-flow boundaries and invalidates unknown mutations. An observation establishes that a method and route were configured on the same builder at a point in code; later overrides, dispatch, authentication requirements, status codes, payloads, and server availability remain unresolved.

Unknown methods remain unknown in OpenAPI. Generic request editors are not recovered schemas. Embedded native/JavaScript code, dynamic routes, and server-driven behavior are not exhaustively covered. The OpenAPI files are partial research artifacts, not an official SDK or supported contract.

Source base APK SHA-256:

4ca96b2b4023878010c5a1dd100662f5edb8b6f05c3b7a400c0c1ba251dfc52b

APKs, native/resource binaries, complete DEX dumps, device permission state, device installation paths, local process logs, and analysis-engine downloads are not distributed. Normalized REA records retain evidence IDs but omit raw provider transcripts and machine details. See PUBLIC_EXPORT.json.

cd api
npm ci --ignore-scripts
npm run build
npm run validate
npm test
python3 bulk-trace/test_extract.py

Validation checks OpenAPI structure, JSON/YAML parity, template collisions, path parameters, operation IDs, and provenance. Tests exercise adversarial DEX tracking and mocked proxy forwarding, method/body/query preservation, credential clearing, origin/token checks, redirects, and error handling. No account credentials are used by the tests.

Start with the complete reproduction guide for tool installation, APK acquisition, the command sequence, and expected outputs. Use the porting guide to trace a new version and create a digest-bound mapping profile. APKs and downloaded engines remain your local inputs.

python3 scripts/doctor.py
npm ci --ignore-scripts --prefix api
python3 scripts/pull-apks.py --package com.instagram.android --output apks
python3 scripts/reproduce.py --apk-dir apks --output runs/current --routes-only --package com.instagram.android --version YOUR_INSTALLED_VERSION

For the exact reference base digest, omit --routes-only and its user-supplied labels to use the checked-in validated profile. Another APK is rejected by that profile before output is written; it must start route-only or use a newly reviewed profile. Runs go into new directories and do not overwrite the reference snapshot.

The output contains an inventory, deterministic string index, candidate catalog, method/path observations where traced, validated OpenAPI JSON/YAML, and a run receipt with input/profile/tooling/output hashes. Report regeneration supports sanitized public evidence; helper ranking reads the bundled gzip directly. See VALIDATION.md for checks actually performed.

Developer checks:

npm test --prefix api
python3 api/bulk-trace/test_extract.py
python3 scripts/test_reproduce.py

Static extraction needs no Instagram account or cookies. Optional method decompilation uses REA 6.5.0, a full JDK 17+, and a separately verified JADX headless MCP 0.7.1 engine. The setup steps and MCP examples are in the reproduction guide. Packed/native/server behavior remains outside the DEX pipeline.

The server binds only to 127.0.0.1. Credentials stay in process memory until disconnect or shutdown and are not written to files or browser storage. The proxy checks local host/origin and a per-process request token, permits only a fixed allowlist of HTTPS upstreams, does not follow redirects, strips upstream cookies, and bounds requests and responses. Do not expose it publicly or put a tunneling service in front of it. See SECURITY.md.

Original workbench code and analysis scripts are MIT licensed. Third-party Swagger assets keep their upstream licenses. Extracted identifiers, metadata, and decompiler evidence are research material; the MIT license does not grant rights to Instagram software. See THIRD_PARTY_NOTICES.md.

Independent research project; not affiliated with or endorsed by Instagram or Meta.