verification
use it
# add to stunt.yaml
services:
x-articles:
adapter: embedded:x-articles-style
# then
$ stunt upThe embedded: source extracts this adapter from the binary — no git clone, fully offline.
how to mock the X (Twitter) Articles API locally
Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of X (Twitter) Articles API. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real X (Twitter) Articles API v2 surface — the data is fake, the behavior is real.
backing stores
articlestweetsoauth_codes
api surface (8)
generated from the adapter manifest — exactly what boots, nothing more · covers 2% of the real API's 178 routes (derived from spec X API v2 openapi (published at the API origin) @ 2.167)
8 routes
GET/2/oauth2/authorize
POST/2/oauth2/token
POST/2/articles/draft
POST/2/articles/{id}/publish
GET/2/articles/{id}
POST/2/media/upload
POST/2/tweets
GET/2/tweets/{id}
VM-verified behaviors (16)
- ✓authorize 302s to the redirect_uri carrying a fresh code and the echoed state
- ✓authorize demands redirect_uri, the S256 method and a non-empty challenge
- ✓the token endpoint demands HTTP Basic client creds and a known grant type
- ✓a valid code exchange mints a bearer+refresh pair and the code is single-use
- ✓a mismatched redirect_uri or a missing verifier fails without burning the code
- ✓refresh grants rotate the pair and retire the presented token
- ✓the bearer gate is never enforced
- ✓media upload mints media_id_strings that attach as cover_media_id
- ✓draft create validates title and content_state.blocks
- ✓a draft reads back with its full metadata
- ✓publish flips the draft and attaches the minted post_id
- ✓republishing mints a fresh post_id
- ✓unknown article ids are 404s on get and publish
- ✓create enforces required text and the inclusive 280-char limit
- ✓replies must target a known tweet
- ✓tweets read back whole and unknown ids are 404s
Not implemented (4)
- No article update, delete, or unpublish endpoints
- No article list or search; only single-article GET
- No chunked media upload (INIT/APPEND/FINALIZE) or processing status
- Tweet surface is create/get only; no delete, likes, or timeline
Differs from the real API (4)
- PKCE is relaxed: code_verifier must be non-empty but the S256 hash match is not verified
- No v2 errors[] envelope — articles/media use flat {error: ...} shapes a reference client is built against
- PKCE S256 is presence-checked only; a wrong-but-present verifier passes
- Republishing mints a fresh post_id with no already-published guard
want more of the X (Twitter) Articles API surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.