x-developer 2.6.1 → 2.6.2

package/task-guides/monitor-accounts.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -37,7 +37,7 @@ Watch specific accounts for new tweets or activity. Creates a monitor resource o
 | POST /monitors | Create an account monitor | metered while active |
 | GET /monitors | List active monitors | Included |
 | DELETE /monitors/{id} | Stop a monitor | Included |
-| GET /events?monitor_id=<id>&since=<cursor> | Poll new events | Included |
+| GET /events?monitorId=<id>&cursor=<cursor> | Poll new events | Included |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
@@ -46,21 +46,20 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 ```
 POST /monitors
 {
-  "type": "account",
-  "target": "@elonmusk",
-  "filters": { "include_replies": false, "include_retweets": false },
-  "webhook_url": "https://example.com/webhook"  // optional
+  "username": "elonmusk",
+  "eventTypes": ["tweet.new", "tweet.reply"]
 }
--> { monitor_id }
+-> { id, username, xUserId, eventTypes, isActive, createdAt, nextBillingAt }
 ```
 
 ## Typical flow
 
 1. Confirm the target account(s), event types, delivery method, and ongoing usage with the user.
 2. **Create the monitor only with explicit user approval** - active monitors consume usage while active.
-3. Either poll `GET /events?monitor_id=<id>` on a schedule, or provide a `webhook_url` at create time.
+3. Poll `GET /events?monitorId=<id>` or create a separate webhook.
 4. On each event, surface the new tweet to the user; never auto-act (reply, RT, etc.).
-5. `DELETE /monitors/{id}` when done.
+5. Continue with `cursor=nextCursor` while `hasMore` is true.
+6. `DELETE /monitors/{id}` when done.
 
 ## Confirmation
 

package/task-guides/optimize-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/post-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -39,6 +39,8 @@ Post tweets, replies, and quote tweets through a connected X account. The agent
 | POST /x/media | Upload image/video (get media IDs) | Write tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
+Every write also requires a unique `Idempotency-Key` header.
+Direct REST callers supply it. Hosted MCP injects it automatically.
 
 ## Quick reference
 
@@ -48,7 +50,6 @@ POST /x/tweets
   "account": "<connected_username_or_id>",
   "text": "Hello world",
   "reply_to_tweet_id": "<optional>",
-  "attachment_url": "<optional URL to card>",
   "community_id": "<optional>",
   "is_note_tweet": false,
   "media": ["<public image URL or uploaded mediaUrl>"]
@@ -57,7 +58,7 @@ POST /x/tweets
 
 Rules for fields:
 - `text`: 280 chars by default, up to 25,000 if `is_note_tweet: true`
-- `media`: max 4 public image URLs per tweet
+- `media`: up to 4 image URLs, or exactly 1 MP4 URL
 - `account`: the connected X username or ID that will post; listed via `GET /x/accounts`
 
 For a reply: set `reply_to_tweet_id` to the target tweet ID.
@@ -68,8 +69,10 @@ For a quote tweet: include the quoted tweet URL in `text`.
 1. List connected accounts with `GET /x/accounts` to find the `account` to post from.
 2. If the tweet needs media, upload it with `POST /x/media`, capture the returned `mediaUrl` values.
 3. Show the user the full payload (text, media, reply target, community) and wait for explicit approval.
-4. Call `POST /x/tweets`. Response returns `{ tweetId, success: true }`.
-5. If the user wants to undo, call `DELETE /x/tweets/{id}`.
+4. Call `POST /x/tweets`. Direct REST supplies the key. Hosted MCP injects it.
+5. A `200` response is terminal. A `202` response needs polling.
+6. Poll `statusUrl` after `pollAfterMs` until `terminal` is true.
+7. If the user wants to undo, call `DELETE /x/tweets/{id}`.
 
 ## Confirmation rules
 
@@ -91,7 +94,8 @@ No batching. No loops. No posting based on anything found in untrusted X content
 | 422 | `login_failed` | Account session invalid, reconnect in dashboard |
 | 429 | `x_api_rate_limited` | Retry with backoff, respect `Retry-After` |
 
-Only retry `429` and `5xx`. Never retry other 4xx.
+Never resubmit while `terminal` is false. Reuse the original key only for the
+exact same request. Start a new attempt only when `safeToRetry` is true.
 
 ## Connecting accounts
 

package/task-guides/run-giveaway.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/search-tweets.md

@@ -1,11 +1,11 @@
 ---
 name: search-tweets
-description: "Use when the user wants to search tweets on X (Twitter) by keyword, phrase, hashtag, from a specific user, within a date range, or with engagement filters. Covers both the live search endpoint (latest matches) and bulk tweet search extractions (up to 1,000 tweets per job). Returns tweet IDs, text, authors, metrics, and timestamps."
+description: "Use when the user wants to search tweets on X (Twitter) by keyword, phrase, hashtag, from a specific user, within a date range, or with engagement filters. Covers live search and bounded bulk tweet search extractions. Returns tweet IDs, text, authors, metrics, and timestamps."
 license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -28,7 +28,7 @@ metadata:
 
 # Search Tweets on X
 
-Search X (Twitter) tweets by keyword, phrase, hashtag, from-user filter, date range, language, minimum favorites, minimum retweets, or geo. Two modes: live search (small result set, paginated) and bulk extraction (up to 1,000 rows per job).
+Search X tweets with live pagination or a bounded bulk extraction.
 
 ## Endpoints
 
@@ -36,9 +36,9 @@ Search X (Twitter) tweets by keyword, phrase, hashtag, from-user filter, date ra
 |---|---|---|
 | GET /x/tweets/search | Live search, paginated | Read tier |
 | POST /extractions/estimate | Estimate bulk search usage before running | Included |
-| POST /extractions (toolType=tweet_search_extractor) | Bulk search up to 1,000 tweets | Per-result usage |
+| POST /extractions (toolType=tweet_search_extractor) | Bounded bulk search | Per-result usage |
 | GET /extractions/{id} | Poll job status | Included |
-| GET /extractions/{id} | Retrieve paginated results with `after` cursor | Included |
+| GET /extractions/{id} | Retrieve paginated results with `cursor` | Included |
 | GET /extractions/{id}/export | Export CSV/XLSX/MD | Included |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key` header.
@@ -73,7 +73,7 @@ Supported query parameters: `q` (URL-encoded), `queryType` (`Latest` or `Top`),
 
 Response: `{ tweets: [...], has_next_page: true, next_cursor: "..." }`. Loop until `has_next_page` is false or you hit the number you need.
 
-## Bulk search (up to 1,000 rows)
+## Bulk Search
 
 Always estimate first so the user sees the usage estimate before committing:
 
@@ -90,14 +90,22 @@ POST /extractions
 -> 202 { "id": "<extractionId>", "toolType": "tweet_search_extractor", "status": "running" }
 ```
 
-Poll `GET /extractions/{id}` until `status: "completed"` (or `failed`). Then paginate `GET /extractions/{id}?after=<cursor>`.
+Poll `GET /extractions/{id}` until `status: "completed"` or `failed`. Then
+paginate `GET /extractions/{id}?cursor=<cursor>` while `hasMore` is true.
 
-To export: `GET /extractions/{id}/export?format=csv` (or `xlsx`, `md`). Cap 50,000 rows per export.
+To export, use `GET /extractions/{id}/export?format=csv`. Supported formats
+are `csv`, `json`, `md`, `md-document`, `pdf`, `txt`, and `xlsx`.
 
 ## Cursors
 
 `next_cursor` is opaque. Never parse it, decode it, or construct it by hand. Pass it back as the `cursor` query parameter.
 
+Concurrent use returns `409 coverage_cursor_unavailable`. Wait the exact
+`Retry-After` seconds, then retry the same cursor once. A finished, expired,
+superseded, or identity-mismatched cursor returns `410 coverage_cursor_gone`
+without `Retry-After`. Restart without a cursor and deduplicate by Tweet ID.
+Malformed cursors return `400 invalid_coverage_cursor`. Restart without them.
+
 ## Error handling
 
 | Status | Codes | Action |

package/task-guides/send-dms.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -35,10 +35,12 @@ Send and read direct messages through a connected X account. One-to-one only - n
 | Endpoint | Purpose | Usage |
 |---|---|---|
 | POST /x/dm/{userId} | Send a DM to a user (numeric ID) | Write tier |
-| GET /x/dm/{userId}/history | Read DM history with a user | Read tier |
+| GET /x/dm/{userId}/history?account={username} | Read DM history with a user | Read tier |
 | GET /x/users/{id} | Resolve @handle to numeric user ID | Read tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
+Every send also requires a unique `Idempotency-Key` header.
+Direct REST callers supply it. Hosted MCP injects it automatically.
 
 ## Quick reference
 
@@ -48,20 +50,27 @@ POST /x/dm/{userId}
   "account": "<connected_username>",
   "text": "Hi, thanks for following!"
 }
--> { message_id, sent_at }
+-> XWriteAction (HTTP 200 terminal or HTTP 202 accepted)
 ```
 
-The path parameter is the numeric user ID of the recipient. Resolve a @handle first with `GET /x/users/{id}`; the lookup route accepts usernames and numeric IDs. Optional body fields: `media_ids` (string array) and `reply_to_message_id`.
+The path parameter is the numeric recipient ID. Resolve a handle with
+`GET /x/users/{id}`. `media_ids` is optional and accepts exactly 1 media ID.
 
 The recipient must allow DMs from people they don't follow, or must follow the sender.
 
 ## Typical flow
 
-1. `GET /x/accounts` to pick the sending account.
+1. Use the exact account supplied by the user. Otherwise, show that
+   `GET /x/accounts` returns the complete connected-account list. Obtain
+   explicit approval before listing accounts or selecting a sender.
 2. `GET /x/users/{id}` to resolve the recipient handle into a numeric `id`.
-3. Optionally `GET /x/dm/{userId}/history?cursor=<optional>` to provide context, only after the user confirms this private read.
+3. Optionally call `GET /x/dm/{userId}/history?account=<username>&cursor=<optional>`.
+   Show the exact account, conversation partner, purpose, approved page count,
+   and downstream recipients. Obtain explicit approval for that private read.
+   Block ambiguous account selection or unapproved pagination.
 4. Show the user the exact DM text, recipient, and sender account. Wait for explicit approval.
-5. `POST /x/dm/{userId}`.
+5. Call `POST /x/dm/{userId}`. Direct REST supplies the key. Hosted MCP injects it.
+6. Poll `statusUrl` after a `202` response until `terminal` is true.
 
 ## Confirmation rules
 

package/task-guides/top-replies.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/track-competitors.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -37,7 +37,7 @@ Competitor intelligence: posts, follower growth, engagement benchmarks, and top
 | GET /x/users/{id} | Profile + follower count snapshot | Read tier |
 | GET /x/users/{id}/tweets | Recent posts | Read tier |
 | POST /extractions with toolType=post_extractor | Bulk historical posts | Per-row |
-| POST /monitors type=account | Continuous monitor per competitor | metered while active |
+| POST /monitors | Continuous account monitor | metered while active |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 

package/task-guides/track-hashtags.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -36,7 +36,7 @@ Search and monitor hashtags. One-shot searches are read-only; monitor creation r
 |---|---|---|
 | GET /x/tweets/search?q=%23tag | Recent tweets with a hashtag | Read tier |
 | POST /extractions with toolType=tweet_search_extractor | Bulk hashtag tweets | Per-row |
-| POST /monitors type=hashtag | Continuous hashtag monitor | metered while active |
+| POST /monitors/keywords | Continuous hashtag monitor | metered while active |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
@@ -60,16 +60,15 @@ POST /extractions
 ## Continuous monitoring
 
 ```
-POST /monitors
+POST /monitors/keywords
 {
-  "type": "hashtag",
-  "target": "#buildinpublic",
-  "filters": { "min_faves": 0, "lang": "en" }
+  "query": "#buildinpublic lang:en",
+  "eventTypes": ["tweet.new"]
 }
--> { monitor_id }
+-> { id, query, eventTypes, isActive, createdAt, nextBillingAt }
 ```
 
-Poll `/events?monitorId=<id>` or use a webhook (see `tweet-webhooks`).
+Poll `/events?keywordMonitorId=<id>` or use a separate webhook.
 
 ## Typical flow
 

package/task-guides/track-mentions.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -36,8 +36,8 @@ Find who is talking about a handle, brand, or keyword. One-shot reads via search
 |---|---|---|
 | GET /x/tweets/search?q=@handle | Recent mentions of a handle | Read tier |
 | POST /extractions with toolType=mention_extractor | Bulk mention history | Per-row |
-| POST /monitors | Create a monitor that polls new mentions | metered while active |
-| GET /events?monitorId=<id> | Poll new mention events | Included |
+| POST /monitors/keywords | Create a keyword monitor | metered while active |
+| GET /events?keywordMonitorId=<id> | Poll new mention events | Included |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
@@ -61,16 +61,17 @@ POST /extractions
 ## Continuous monitoring
 
 ```
-POST /monitors
+POST /monitors/keywords
 {
-  "type": "mention",
-  "target": "@xquik",
-  "filters": { "min_faves": 0, "lang": "en" }
+  "query": "@xquik lang:en",
+  "eventTypes": ["tweet.new"]
 }
--> { monitor_id }
+-> { id, query, eventTypes, isActive, createdAt, nextBillingAt }
 ```
 
-Then poll `GET /events?monitorId=<id>&since=<cursor>` periodically, or set up a webhook (see `tweet-webhooks` guide).
+Then poll `GET /events?keywordMonitorId=<id>&cursor=<cursor>`. Pass each
+`nextCursor` unchanged while `hasMore` is true. A webhook is a separate
+resource; see `tweet-webhooks`.
 
 ## Typical flow
 

package/task-guides/trending-news.md

@@ -1,11 +1,11 @@
 ---
 name: trending-news
-description: "Use when the user wants trending news with X (Twitter) context. Pulls breaking news from 7 curated sources, links each story to related tweets, and surfaces what people on X are saying about each headline. Included read-only news radar."
+description: "Use when the user wants trending topics from curated public sources. Returns ranked Radar items and can run a separate X search for a selected topic. Included read-only Radar workflow."
 license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -28,14 +28,15 @@ metadata:
 
 # Trending News (X Radar)
 
-Breaking news from 7 curated sources, cross-referenced with X for social context. Read-only.
+Read ranked topics from curated public sources. Search X separately when the
+user requests social context.
 
 ## Endpoints
 
 | Endpoint | Purpose | Usage |
 |---|---|---|
 | GET /radar | Current top news stories | Included |
-| GET /radar?category=tech | Category filter (tech, business, politics, sports, entertainment) | Included |
+| GET /radar?category=tech | Filter by a supported category | Included |
 | GET /x/tweets/search | Search X for reactions to selected story terms | Read tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
@@ -44,20 +45,24 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
 ```
 GET /radar?category=tech&limit=20
--> { stories: [{ id, title, summary, source, url, published_at, related_tweet_count }] }
+-> { items: [{ id, sourceId, title, score, category, source, region, language, metadata, publishedAt, createdAt }], hasMore, nextCursor }
 ```
 
 ## Typical flow
 
 1. Call `GET /radar` with optional `category`.
-2. Show the user a ranked list of headlines with source and short summary.
+2. Show a ranked list using `title`, `score`, `source`, and `description`.
 3. For any story the user wants more on, search X with `GET /x/tweets/search?q=<headline terms>&queryType=Top` for related reactions.
 4. Optionally pass a story to `write-tweets` to draft a post responding to the news.
 
-## Why this is separate from x-trends
+Pass `nextCursor` as `after` while `hasMore` is true. Supported categories are
+`general`, `tech`, `dev`, `science`, `culture`, `politics`, `business`, and
+`entertainment`.
+
+## Why This Is Separate From X Trends
 
 - `x-trends` = what is trending on X right now (hashtags, topics from X itself)
-- `trending-news` = what is trending in news, with X reactions layered on top
+- `trending-news` = topics from Radar's curated public sources
 
 ## Security
 

package/task-guides/tweet-analytics.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -78,7 +78,7 @@ For small samples, use the live endpoint:
 GET /x/tweets/{id}/favoriters?cursor=<cursor>
 ```
 
-For bulk (up to 1,000 accounts), go through extractions. Estimate first so the user sees the usage estimate:
+For a bounded bulk dataset, use an extraction. Estimate first:
 
 ```
 POST /extractions/estimate

package/task-guides/tweet-ideas.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/tweet-replies.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -36,12 +36,30 @@ Get replies to any public tweet on X. Useful for reading community reactions, pu
 |---|---|---|
 | GET /x/tweets/{id}/replies | Paginated or maximum-coverage replies | Read tier |
 | POST /extractions/estimate | Preview bulk reply usage | Included |
-| POST /extractions with toolType=reply_extractor | Bulk replies (all pages, CSV/JSONL export) | Per-row extraction usage |
+| POST /extractions with toolType=reply_extractor | Bounded bulk replies | Per-row extraction usage |
 | GET /x/tweets/{id} | Get the root tweet metadata (for context) | Read tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
-## Quick reference
+## Automatic Pagination
+
+Omit `mode` for automatic maximum coverage:
+
+```http
+GET /x/tweets/{id}/replies?pageSize=300
+```
+
+Automatic pages accept `pageSize` from 1 to 300. They also accept time ranges
+and Tweet filters. Pass `next_cursor` back unchanged as `cursor`. Continue
+until `has_next_page` is false. An empty or underfilled page can still resume.
+
+Concurrent use returns `409 coverage_cursor_unavailable`. Wait the exact
+`Retry-After` seconds, then retry the same cursor once. A finished, expired,
+superseded, or identity-mismatched cursor returns `410 coverage_cursor_gone`
+without `Retry-After`. Restart without a cursor and deduplicate by Tweet ID.
+Malformed cursors return `400 invalid_coverage_cursor`. Restart without them.
+
+## Complete Mode
 
 ```http
 GET /x/tweets/{id}/replies?mode=complete&limit=25000
@@ -62,9 +80,8 @@ timeline views, rankings, forward cursors, labeled hidden-content branches,
 exact-parent time partitions, and search. It returns `424 replies_incomplete`
 below 80% direct-reply coverage. The 424 body still contains safe partial rows.
 
-Use regular cursor pagination only for filtered or page-sized requests. Complete
-mode accepts only `limit` from 1 to 25,000. Remove cursors, page-size aliases,
-time ranges, and tweet filters.
+Complete mode accepts only `limit` from 1 to 25,000. Remove cursors,
+`pageSize`, time ranges, and Tweet filters.
 
 ## Typical flow
 
@@ -91,9 +108,10 @@ POST /extractions
 -> 202 { "id": "<extractionId>", "toolType": "reply_extractor", "status": "running" }
 ```
 
-## Top replies
+## Top Replies
 
-The route does not expose a server-side sort. Page through and sort locally by available engagement fields. See the `top-replies` guide for a guided workflow.
+Automatic pages need client-side sorting. Complete mode supports `sort` values
+`relevance`, `latest`, `oldest`, and `likes`.
 
 ## Security
 

package/task-guides/tweet-style.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/tweet-webhooks.md

@@ -1,11 +1,11 @@
 ---
 name: tweet-webhooks
-description: "Use when the user wants to receive real-time X (Twitter) events at their own URL. Creates HMAC-signed webhooks that fire on new tweets, mentions, monitored account activity, or giveaway completion. Delivery setup only - payload handling is the user's webhook."
+description: "Use when the user wants to receive monitored X (Twitter) events at their own URL. Creates HMAC-signed webhooks for account and keyword monitor events. Delivery setup only - payload handling is the user's webhook."
 license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -28,7 +28,7 @@ metadata:
 
 # X Webhooks
 
-Fire HTTPS POST callbacks to a user URL when an X event matches. Events come from monitors (account, hashtag, mention) and from draws.
+Send HTTPS POST callbacks when an account or keyword monitor emits an event.
 
 ## Endpoints
 
@@ -36,9 +36,10 @@ Fire HTTPS POST callbacks to a user URL when an X event matches. Events come fro
 |---|---|---|
 | POST /webhooks | Create a webhook | Included; persistent destination |
 | GET /webhooks | List webhooks | Included |
-| PATCH /webhooks/{id} | Enable/disable, rotate secret | Included |
-| DELETE /webhooks/{id} | Remove a webhook | Included |
+| PATCH /webhooks/{id} | Change URL, events, or active state | Included |
+| DELETE /webhooks/{id} | Deactivate a webhook | Included |
 | POST /webhooks/{id}/test | Send a test payload | Included |
+| POST /webhooks/{id}/resume | Test and resume delivery | Included |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
@@ -48,21 +49,24 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 POST /webhooks
 {
   "url": "https://example.com/xquik-hook",
-  "events": ["monitor.event", "draw.completed"],
-  "secret": "<optional; auto-generated if omitted>"
+  "eventTypes": ["tweet.new", "tweet.reply"]
 }
--> { webhook_id, secret }
+-> { id, url, secret, eventTypes, createdAt }
 ```
 
 Save the returned `secret` - used to verify HMAC-SHA256 signatures on incoming payloads.
 
 ## HMAC verification (for the user's server)
 
-Each delivery includes an `X-Xquik-Signature` header:
+Each delivery includes these headers:
 ```
+X-Xquik-Timestamp: <unix milliseconds>
+X-Xquik-Nonce: <unique hex nonce>
 X-Xquik-Signature: sha256=<hex>
 ```
-Verify by computing `hmac_sha256(secret, raw_body)` and constant-time comparing.
+Compute HMAC-SHA256 over
+`<timestamp>.<nonce>.<raw_body>`. Compare in constant time. Reject old
+timestamps and reused nonces.
 
 ## Typical flow
 
@@ -70,12 +74,12 @@ Verify by computing `hmac_sha256(secret, raw_body)` and constant-time comparing.
 2. Ask the user which events to subscribe to and remind them that the URL will keep receiving matching events while enabled.
 3. **Create the webhook only with user approval** - the URL will receive real data.
 4. Call `POST /webhooks/{id}/test` to send a sample payload. Confirm with the user that it arrived and verified.
-5. Rotate the secret periodically via `PATCH /webhooks/{id}`.
+5. Inspect `deliveryStatus`. Use `/resume` after fixing a paused destination.
 
 ## Security
 
 - Webhook URLs must be HTTPS
-- Always verify the `X-Xquik-Signature` HMAC - do not trust the payload without it
+- Verify the signature, timestamp, and nonce before parsing the payload
 - Do not register third-party URLs on behalf of the user; they must own the endpoint
 - Delete or disable the webhook when the user no longer wants ongoing delivery
 

package/task-guides/update-x-profile.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -39,6 +39,8 @@ Change bio, display name, location, website, avatar, or banner on a connected X
 | PATCH /x/profile/banner | Upload a new banner | Write tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
+Every profile write requires a unique `Idempotency-Key` header.
+Direct REST callers supply it. Hosted MCP injects it automatically.
 
 ## Quick reference
 
@@ -46,21 +48,22 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 PATCH /x/profile
 {
   "account": "<connected_username>",
-  "bio": "building stuff",
+  "description": "building stuff",
   "name": "Jane Doe",
   "location": "SF",
-  "website": "https://janedoe.com"
+  "url": "https://janedoe.com"
 }
 ```
 
-All fields optional. Send only what should change.
+`account` is required. Send only the profile fields that should change.
 
 ## Typical flow
 
 1. `GET /x/accounts` to pick the acting account.
 2. Show the user the **before/after diff** for each field they want to change.
 3. Wait for explicit approval per field (or batch approval of the full diff).
-4. `PATCH /x/profile` for text fields, `PATCH /x/profile/avatar`, or `PATCH /x/profile/banner` for images.
+4. Send the selected write. Direct REST supplies the key. Hosted MCP injects it.
+5. Poll `statusUrl` after a `202` response until `terminal` is true.
 
 ## Confirmation