The XAutoDM API Reference

Base URL & authentication

All requests go to api.xautodm.com and authenticate with a bearer key. Keep your key server-side; never ship it to a browser. Test keys (xdm_test_…) run in dry-run mode: no real sends, no credits spent, so you can build the whole flow safely.

Base URL:  https://api.xautodm.com/v1
Auth:      Authorization: Bearer xdm_live_...

Pulling leads

Lead sources are plain GET endpoints returning profile objects, each with an accurate can_dm flag so you never spend a send on someone you cannot reach. Results are cursor-paginated.

curl https://api.xautodm.com/v1/users/naval/followers \
  -H "Authorization: Bearer xdm_live_..."

Lead sources

• /users/{handle}/followers and /following
• /users/{handle}/verified-followers — verified accounts only
• /users/{handle}/mentions — accounts mentioning a handle
• /users/search — accounts matching a keyword query
• /tweets/{id}/replies — everyone who replied to a tweet
• /tweets/{id}/retweeters — everyone who retweeted a tweet
• /lists/{id}/members — members of a public List

Response

{
  "data": [
    {
      "id": "1234567890",
      "handle": "someone",
      "name": "Some One",
      "bio": "Founder, building in public",
      "followers": 4213,
      "verified": false,
      "can_dm": true
    }
  ]
}

Sending a DM

Connect an X account once, then send from it by account_id. Every write requires an Idempotency-Key, so a retried request is never double-sent or double-charged.

curl -X POST https://api.xautodm.com/v1/dm/send \
  -H "Authorization: Bearer xdm_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "account_id": "<id>",
    "recipient_username": "someone",
    "text": "Hey, saw you are building in public..."
  }'

More endpoints

Account connect and reconnect (/accounts), reading conversations (/dm/conversations), growth actions (/actions/follow, /unfollow, /like, /retweet), posting tweets, plus /account and /usage for your plan and credit balance. All sends go through the same safety engine as the app (safe daily caps, pacing, do-not-contact), and the API cannot bypass those rails. Full parameters and credit costs are in the API docs.