TLS grade A+
A+Qualys SSL Labs, api.sorsa.io
Qualys SSL Labs, an independent test, rates api.sorsa.io A+.
Reviewed 3 November 2026
A Twitter/X API & scraper you can trust in production
In production since 2022, with 6B+ requests served and 99.9% uptime guaranteed in our terms. Public X data only, no X login, and failed requests are never charged. See how we protect your account, keys and data, and check every claim yourself.
No credit card, and they never expire.
6B+
Requests served
Since 2022, formerly TweetScout API
99.9%
Uptime, guaranteed
In our terms, on every paid plan
0
X logins we ask for
Your account is never involved
$0
For a failed request
Errors are never charged
A real company behind every request.
Sorsa API is built and run by Scouts Labs Inc. It launched in 2022 as TweetScout API, took the name Sorsa API in 2025, and today is trusted by 2,500+ developers and 100+ companies, with 6B+ requests served.
Scouts Labs Inc
The company that builds and runs Sorsa API
- Registered office
- Intershore Chambers, PO Box 4642, Road Town, Tortola, VG1111, British Virgin Islands
- In production
- Since 2022, first as TweetScout API
- Product
- Sorsa API, api.sorsa.io
- Write to us
- contacts@sorsa.io
- Independent
- Not affiliated with, endorsed by, or sponsored by X Corp.
Our track record, with receipts
- 2022
TweetScout launches; its API serves X data to analytics teams.
Archived site, November 2022 - 2025
TweetScout API becomes Sorsa API: new name, same team and infrastructure.
GitHub: Sorsa-io - 2026
Sorsa MCP ships for AI agents, open source under MIT.
npm: sorsa-mcp - Today
45 endpoints, every one in a public OpenAPI spec.
The spec
Read the full story on about Sorsa API
Public data in. Your X account stays out.
Sorsa API reads public X data, fetched live when you ask. It never asks for your X login, never acts on any account, and never touches protected accounts or DMs.
Sorsa API reads
- Public posts, replies and quotes
- Public profiles
- Followers and following
- Lists, Communities and Spaces
- Search back to 2006
- Follow, repost, quote and comment checks
Sorsa API never touches
- Protected accounts
- Direct messages
- Your X login, cookies or tokens
- Posting, likes, follows or DMs
How a request moves
- 1
Your server calls Sorsa API.
One API key in the
ApiKeyheader, over TLS 1.2 or 1.3. - 2
Sorsa API checks the key.
A missing or wrong key is turned away before any data is read.
- 3
Sorsa API reads public X data, live.
Nothing of yours goes along: no login, no cookies, no account. X never learns who is asking: your key and your account never leave Sorsa API.
- 4
Clean JSON comes back.
If the call fails, it costs you nothing.
Built for production, not for weekend scripts.
99.9% uptime, guaranteed in our terms on every paid plan. The response schema stays stable, and we give notice ahead of changes that could break an integration.
99.9%
Uptime guarantee
Every month, on every paid plan, written into Section 7.1 of our Terms of Service.
If uptime in a month ever drops below 99.5%, we add bonus requests to your account: 10% of your monthly requests. They work on every endpoint, like the requests in your plan.
How we measure
We check the Sorsa API every minute. Downtime is time when it returns server errors or stops responding. Outages on X’s side, maintenance we announce a day ahead and invalid requests don’t count.
- Failed requests are never charged.A server error or a rejected key costs you nothing.
- 20 requests per second on every plan.Need more? We raise it for your workload.
- Every request is fetched live.Sorsa API reads X when you call it, so the data is never a stale copy.
- One stable contract.API v3, with all 45 endpoints in a public OpenAPI spec.
Support that grows with you
Talk to sales- 1
Fast answers from the team, in your dashboard
- 2
Priority support on Enterprise
- 3
A dedicated account manager on Business and larger plans
- 4
Dedicated infrastructure on Hyperscale
- 5
From 1 million requests a month, an SLA we sign with you
Proof you can run.
Badges ask you to believe. These checks don’t: open the independent report, or copy a command into any terminal and compare the answer.
Independent reportOpen the SSL Labs report
A+Qualys SSL Labs, api.sorsa.io
Overall Rating: A+1 / 6Qualys SSL Labs, an independent test, rates api.sorsa.io A+.
Terminal
openssl s_client -connect api.sorsa.io:443 </dev/null 2>/dev/null | grep "^New"New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA2562 / 6Your requests travel encrypted with TLS 1.3.
Terminal
openssl s_client -connect api.sorsa.io:443 -tls1_1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null 2>&1 | grep -o "alert protocol version"alert protocol version3 / 6Our server turns away TLS 1.0 and 1.1.
Terminal
curl -sI https://api.sorsa.io | grep -i strict-transportStrict-Transport-Security: max-age=63072000; includeSubDomains4 / 6Browsers keep to HTTPS for two years.
Terminal
curl -s "https://api.sorsa.io/v3/info?username=x" -H "ApiKey: wrong-key"{"message":"invalid api key"}5 / 6A request without a valid key is refused before anything is read.
Terminal
curl -s https://api.sorsa.io/v3/swagger.json | jq '.paths | length'456 / 6Every endpoint is described in an OpenAPI spec anyone can read.
Run these against any X data API you’re considering.
Your keys and your bill, under your control.
One API key in one header, as many keys as you need, and limits that stop a runaway script before it costs you.
API keysEvery key works with every endpoint.
Create key- Production appLast used today
7c2e••••3f9aRoll keyDelete - StagingLast used yesterday
b41d••••a71c - Research agentNever used
05fa••••0d42
- A key per app keeps their usage apart.
- Roll a key to get a new value; its name and history stay.
- Delete a key and it stops working at once.
- Cap any key at a number of requests.
- Alerts before you run out.At the thresholds you choose (50%, 80%, 90%), by email or Telegram.
- Pay as you go only if you want it.It stays off until you switch it on, with a spending limit of $100 a period by default, yours to change.
- Cards through Stripe.We never store your full card number.
- Pay with crypto, nothing renews.A one-time payment for a month or a year; we remind you before it ends.
- Cancel any time.From the dashboard; your plan runs to the end of the period you paid for.
- Your price stays put.It never goes up while you stay subscribed. See the Terms
Start on 100 free requests and grow on the same API.
What we keep, and what we never do.
We keep what it takes to run your account and show you your usage. We don’t sell it, and advertisers never see your keys or what you look up.
Sorsa API privacy label
We keep
- Your email and sign-in methodwhile your account is active
- Request logs: what you called and when1 year
- The full responses to your requests30 days
- Payment records, without card numbersas tax law requires
- Support messagesto keep your support history
We never
- Sell your personal data
- Send your email, keys or request content to advertising platforms
- Set analytics or ad cookies without your OK
- Ask for your X login
You can
- Delete your account yourself, any time
- Get, correct or erase your data: write to contacts@sorsa.io
- Change your cookie choices any time
- Ask for a Data Processing Agreement
Full details: Privacy Policy, updated November 5, 2026
People in the data
If your public X profile or posts appear through Sorsa API and you have a privacy concern, write to contacts@sorsa.io.
Everything your security review will ask.
The answers security, legal and procurement teams need, in one place.
- Who operates Sorsa API?
- Scouts Labs Inc, Road Town, Tortola, British Virgin Islands. In production since 2022.
- What does the API do?
- Read-only access to public X data through one REST API. No writes to X, no customer X credentials.
- What data do you hold about us?
- Account and sign-in data, request logs, the full responses to your requests, payment records without card numbers, support messages.
- Who controls the data in responses?
- You do: you’re the controller of any personal data in the responses you receive. A DPA is available on request.
- How is data protected in transit?
- TLS 1.2 and 1.3 only, older versions refused; HSTS on api.sorsa.io; SSL Labs grade A+.
- How do API keys work?
- One key per request in the ApiKey header; several keys per account; roll or delete any key at once.
- How are payments handled?
- Cards through Stripe, crypto through a payment provider; we never store card numbers.
- Which third parties see our data?
- Only the providers that run the service for us (hosting, payments, support tools), bound to use it on our instructions; Google Analytics and Google Ads cookies only with your consent. We don’t sell data.
- How long do you keep logs?
- Request logs, what you called and when, for one year; the full responses to your requests for 30 days; account data while your account is active; payment records as tax law requires.
- How do we report a vulnerability?
- Write to contacts@sorsa.io with the details and the steps to reproduce.
- What availability do you offer?
- 99.9% uptime, guaranteed in Section 7.1 of our Terms on every paid plan, with bonus requests if a month drops below 99.5%; from 1 million requests a month, an SLA we sign with you.
- Does X see who we are?
- No. X never learns who is asking: your API key and your account never leave Sorsa API.
Documents
- Terms of ServiceUpdated November 5, 2026Open
- Privacy PolicyUpdated November 5, 2026Open
- Data Processing AgreementOn requestOpen
- OpenAPI spec45 endpointsOpen
Custom terms, invoices or an SLA we sign with you?
Your free API key
100requests
Up to 10K tweets or 20K profiles.
•••• •••• •••• 7f3aReady after sign-upNo credit card And they never expire.
Get 100 free requestsTrust questions, answered.
Yes. Sorsa API is operated by Scouts Labs Inc and has run in production since 2022, first as TweetScout API. Its prices and terms are public, and failed requests are never charged.
Yes. It reads public X data only, is read-only by design and never asks for your X login. Connections use TLS 1.2 or 1.3 (SSL Labs grade A+), and you can roll or delete any API key at once.
No. Sorsa API never asks for your X login, cookies or tokens, and it never posts, likes or follows, so your account is never involved.
Yes. Sorsa API reads only public X data, the same data any browser or search engine sees without logging in. It never touches protected accounts or DMs and never acts on anyone’s account, so there is nothing to ban. A DPA is available on request for your compliance team.
No. Sorsa API is independent and is not affiliated with, endorsed by, or sponsored by X Corp. It is a separate REST API for public X data, with one API key and no X developer account.
Scouts Labs Inc, registered in Road Town, Tortola, British Virgin Islands. The same team has run the API since 2022, first as TweetScout API.
In production since 2022, with 6B+ requests served and 99.9% uptime guaranteed in our terms on every paid plan. Every request is fetched live, failed requests are never charged, and the response schema stays stable.
Yes. Every paid Sorsa API plan comes with a 99.9% monthly uptime guarantee, written into Section 7.1 of our Terms of Service. If uptime in a month ever drops below 99.5%, we add bonus requests to your account: 10% of your monthly requests. Outages on X’s side don’t count as our downtime, and requests that fail because of them are never charged. From 1 million requests a month, we can also sign an SLA with you.
No. When X changes something, we fix it on our side: your requests and the response schema stay the same, so your code keeps working, and we give notice ahead of changes that could break an integration.
No. One successful call is one request; a server error or a rejected key is never billed.
No. We don’t sell personal data, and we never send your email, API keys or request content to advertising platforms. Analytics cookies run only with your consent.
Request logs, what you called and when, for one year, and the full responses to your requests for 30 days. Your account details stay while your account is active, and payment records as long as tax law requires. Write to contacts@sorsa.io to get, correct or erase your data.
No. Sorsa API reads public X data on its own: your API key, your account and your identity never leave Sorsa API, so X never learns who is asking.
Yes. Card plans cancel from the dashboard and run to the end of the paid period, crypto plans never renew, your 100 free requests never expire, and responses are plain JSON that works anywhere.
Some X data services read or post through a customer’s own X login or cookies. Sorsa API never asks for them: one API key reads public data, so there is no account of yours at risk.
Write to contacts@sorsa.io with the details and the steps to reproduce.
A Twitter/X API & scraper you can trust in production
Since 2022, 99.9% uptime guaranteed. Public data only, no X login, and failed requests are never charged.
No credit card, and they never expire.
The safety card. Tap to read all six.
6B+Requests servedSince 2022, formerly TweetScout API
99.9%Uptime, guaranteedIn our terms, on every paid plan
0X logins we ask forYour account is never involved
$0For a failed requestErrors are never charged
A real company behind every request.
APIOperator
Scouts Labs Inc
OperatorScouts Labs Inc
In production since2022
FormerlyTweetScout API
Independentof X Corp
Road Town, Tortola, British Virgin Islands
Public data in. Your X account stays out.
- Public posts, replies and quotes
- Public profiles
- Followers and following
- Lists, Communities and Spaces
- Search back to 2006
- Follow, repost, quote and comment checks
- Protected accounts
- Direct messages
- Your X login, cookies or tokens
- Posting, likes, follows or DMs
Built for production, not for weekend scripts.
99.9%
Uptime, guaranteed in our terms
Below 99.5% in a month, we add bonus requests: 10% of your monthly requests.
- Failed requests$0
- Every plan20 req/s
- A stable response schema
Proof you can run.
Badges ask you to believe. These checks don’t: open the independent report, or copy a command into any terminal and compare the answer.
TLS 1.3
openssl s_client -connect api.sorsa.io:443 </dev/null 2>/dev/null | grep "^New"New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256Your requests travel encrypted with TLS 1.3.
Old TLS refused
openssl s_client -connect api.sorsa.io:443 -tls1_1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null 2>&1 | grep -o "alert protocol version"alert protocol versionOur server turns away TLS 1.0 and 1.1.
HTTPS remembered
curl -sI https://api.sorsa.io | grep -i strict-transportStrict-Transport-Security: max-age=63072000; includeSubDomainsBrowsers keep to HTTPS for two years.
No key, no data
curl -s "https://api.sorsa.io/v3/info?username=x" -H "ApiKey: wrong-key"{"message":"invalid api key"}A request without a valid key is refused before anything is read.
Public contract
curl -s https://api.sorsa.io/v3/swagger.json | jq '.paths | length'45Every endpoint is described in an OpenAPI spec anyone can read.
1 / 6
Run these against any X data API you’re considering.
Your keys and your bill, under your control.
API keysCreate key
- Production appLast used today
7c2e••••3f9a - StagingLast used yesterday
b41d••••a71c - Research agentNever used
05fa••••0d42
- Roll a key to get a new value; its name and history stay.
- Delete a key and it stops working at once.
- Cap any key at a number of requests.
- Alerts before you run out.At the thresholds you choose (50%, 80%, 90%), by email or Telegram.
- Pay as you go only if you want it.It stays off until you switch it on, with a spending limit of $100 a period by default, yours to change.
- Cards through Stripe.We never store your full card number.
- Pay with crypto, nothing renews.A one-time payment for a month or a year; we remind you before it ends.
- Cancel any time.From the dashboard; your plan runs to the end of the period you paid for.
- Your price stays put.It never goes up while you stay subscribed.
What we keep, and what we never do.
Sorsa API privacy label
- Your email and sign-in methodwhile your account is active
- Request logs: what you called and when1 year
- The full responses to your requests30 days
- Payment records, without card numbersas tax law requires
- Support messagesto keep your support history
- Sell your personal data
- Send your email, keys or request content to advertising platforms
- Set analytics or ad cookies without your OK
- Ask for your X login
- Delete your account yourself, any time
- Get, correct or erase your data: write to contacts@sorsa.io
- Change your cookie choices any time
- Ask for a Data Processing Agreement
Full details: Privacy Policy, updated November 5, 2026
If your public X profile or posts appear through Sorsa API and you have a privacy concern, write to contacts@sorsa.io.
Everything your security review will ask.
Security review
Documents
Terms of ServiceUpdated November 5, 2026Privacy PolicyUpdated November 5, 2026Data Processing AgreementOn requestOpenAPI spec45 endpoints
Custom terms, invoices or an SLA we sign with you?
100requests
Your free API key
Up to 10K tweets or 20K profiles.
•••• •••• •••• 7f3aReady after sign-upNo credit cardAnd they never expire.
Get 100 free requestsTrust questions, answered.
Safety information
1Public data only
Protected accounts and DMs stay out.
2No X login, ever
ApiKeynot needed
7c2e••••3f9aX loginYour X account is never part of it.
3Read-only
No posting, likes, follows or DMs.
4Encrypted
TLS 1.3SSL Labs A+
TLS 1.2 and 1.3 only, graded A+ by SSL Labs.
5Failed request: $0
503
/search-tweetsBilled$0.00Errors are never charged.
699.9% uptime
Every month99.9%
Guaranteed in our terms on every paid plan.
Operated by Scouts Labs Inc since 2022, formerly TweetScout API
If you need us
- Securitycontacts@sorsa.io
- Privacy and datacontacts@sorsa.io
- Billingcontacts@sorsa.io
- SupportYour dashboard
Exits
- Card plans cancel any time.
- Crypto plans never renew.
- Responses are plain JSON.
- Free requests never expire.
Scouts Labs Inc, Road Town, Tortola, British Virgin Islands
Our track record, with receipts
- 2022
TweetScout launches; its API serves X data to analytics teams.
Archived site, November 2022 - 2025
TweetScout API becomes Sorsa API: new name, same team and infrastructure.
GitHub: Sorsa-io - 2026
Sorsa MCP ships for AI agents, open source under MIT.
npm: sorsa-mcp - Today
45 endpoints, every one in a public OpenAPI spec.
The spec
Read the full story on about Sorsa API
How a request moves
- 1
Your server calls Sorsa API.
One API key in the
ApiKeyheader, over TLS 1.2 or 1.3. - 2
Sorsa API checks the key.
A missing or wrong key is turned away before any data is read.
- 3
Sorsa API reads public X data, live.
Nothing of yours goes along: no login, no cookies, no account. X never learns who is asking: your key and your account never leave Sorsa API.
- 4
Clean JSON comes back.
If the call fails, it costs you nothing.
Uptime guarantee
Every month, on every paid plan, written into Section 7.1 of our Terms of Service.
If uptime in a month ever drops below 99.5%, we add bonus requests to your account: 10% of your monthly requests. They work on every endpoint, like the requests in your plan.
How we measure. We check the Sorsa API every minute. Downtime is time when it returns server errors or stops responding. Outages on X’s side, maintenance we announce a day ahead and invalid requests don’t count.
Live status for every endpoint group, public at all times.
Read Section 7.1 of our TermsSupport that grows with you
- 1
Fast answers from the team, in your dashboard
- 2
Priority support on Enterprise
- 3
A dedicated account manager on Business and larger plans
- 4
Dedicated infrastructure on Hyperscale
- 5
From 1 million requests a month, an SLA we sign with you
Who operates Sorsa API?
Scouts Labs Inc, Road Town, Tortola, British Virgin Islands. In production since 2022.
What does the API do?
Read-only access to public X data through one REST API. No writes to X, no customer X credentials.
What data do you hold about us?
Account and sign-in data, request logs, the full responses to your requests, payment records without card numbers, support messages.
Who controls the data in responses?
You do: you’re the controller of any personal data in the responses you receive. A DPA is available on request.
How is data protected in transit?
TLS 1.2 and 1.3 only, older versions refused; HSTS on api.sorsa.io; SSL Labs grade A+.
How do API keys work?
One key per request in the ApiKey header; several keys per account; roll or delete any key at once.
How are payments handled?
Cards through Stripe, crypto through a payment provider; we never store card numbers.
Which third parties see our data?
Only the providers that run the service for us (hosting, payments, support tools), bound to use it on our instructions; Google Analytics and Google Ads cookies only with your consent. We don’t sell data.
How long do you keep logs?
Request logs, what you called and when, for one year; the full responses to your requests for 30 days; account data while your account is active; payment records as tax law requires.
How do we report a vulnerability?
Write to contacts@sorsa.io with the details and the steps to reproduce.
What availability do you offer?
99.9% uptime, guaranteed in Section 7.1 of our Terms on every paid plan, with bonus requests if a month drops below 99.5%; from 1 million requests a month, an SLA we sign with you.
Does X see who we are?
No. X never learns who is asking: your API key and your account never leave Sorsa API.
More answers
Is Sorsa API legit?
Yes. Sorsa API is operated by Scouts Labs Inc and has run in production since 2022, first as TweetScout API. Its prices and terms are public, and failed requests are never charged.
Is Sorsa API safe to use?
Yes. It reads public X data only, is read-only by design and never asks for your X login. Connections use TLS 1.2 or 1.3 (SSL Labs grade A+), and you can roll or delete any API key at once.
Can my X account get banned for using Sorsa API?
No. Sorsa API never asks for your X login, cookies or tokens, and it never posts, likes or follows, so your account is never involved.
Is it legal to use Sorsa API?
Yes. Sorsa API reads only public X data, the same data any browser or search engine sees without logging in. It never touches protected accounts or DMs and never acts on anyone’s account, so there is nothing to ban. A DPA is available on request for your compliance team.
Is Sorsa API an official X API?
No. Sorsa API is independent and is not affiliated with, endorsed by, or sponsored by X Corp. It is a separate REST API for public X data, with one API key and no X developer account.
Who owns Sorsa API?
Scouts Labs Inc, registered in Road Town, Tortola, British Virgin Islands. The same team has run the API since 2022, first as TweetScout API.
How reliable is Sorsa API?
In production since 2022, with 6B+ requests served and 99.9% uptime guaranteed in our terms on every paid plan. Every request is fetched live, failed requests are never charged, and the response schema stays stable.
Do you guarantee uptime?
Yes. Every paid Sorsa API plan comes with a 99.9% monthly uptime guarantee, written into Section 7.1 of our Terms of Service. If uptime in a month ever drops below 99.5%, we add bonus requests to your account: 10% of your monthly requests. Outages on X’s side don’t count as our downtime, and requests that fail because of them are never charged. From 1 million requests a month, we can also sign an SLA with you.
Will my integration break?
No. When X changes something, we fix it on our side: your requests and the response schema stay the same, so your code keeps working, and we give notice ahead of changes that could break an integration.
Am I charged when a request fails?
No. One successful call is one request; a server error or a rejected key is never billed.
Do you sell or share my data?
No. We don’t sell personal data, and we never send your email, API keys or request content to advertising platforms. Analytics cookies run only with your consent.
How long do you keep my data?
Request logs, what you called and when, for one year, and the full responses to your requests for 30 days. Your account details stay while your account is active, and payment records as long as tax law requires. Write to contacts@sorsa.io to get, correct or erase your data.
Does X know that I use Sorsa API?
No. Sorsa API reads public X data on its own: your API key, your account and your identity never leave Sorsa API, so X never learns who is asking.
Can I leave any time?
Yes. Card plans cancel from the dashboard and run to the end of the paid period, crypto plans never renew, your 100 free requests never expire, and responses are plain JSON that works anywhere.
How is Sorsa API different from APIs that use your X account?
Some X data services read or post through a customer’s own X login or cookies. Sorsa API never asks for them: one API key reads public data, so there is no account of yours at risk.
How do I report a security issue?
Write to contacts@sorsa.io with the details and the steps to reproduce.