Fetch an X profile picture URL: GET /tools/profile-pic

What this endpoint answers

Resolves an X handle to its full-resolution avatar URL. Returns found = false with a null URL when the upstream answered but had no picture, so a missing avatar is distinguishable from a failed call.

This is a live read: it goes to the platform at request time, returns cache_age_s = 0, and is metered against a separate live-per-minute bucket on top of your tier. It needs the tools:use scope (Tools): Run the analysis tools: valuation, follower audit, scoring, and more.

Good to know

Costs money: 1 twitterapi.io call. The upstream response is cached for 24 hours, so repeat lookups of the same handle inside that window are free.
Returns 503 not_configured when TWITTERAPI_IO_KEY is unset and 502 upstream_error when the upstream fails.
Avatar URLs are served by X's CDN and rotate when the user changes their picture. Do not treat one as a permanent identifier.

Parameters

Every value the call accepts, with the example the spec ships so the request runs as written.

Name	In	Required	Example	What it does
`handle`	query	required	`naval`	X handle. Accepts a bare name, @name, or a profile URL.

Call it

Authenticate with a bearer token or the x-api-key header. Keys are server-to-server credentials. Never embed one in front-end code - call the API from your own backend and forward the result.

curl

curl "https://crmsolid.com/data-api/v2/tools/profile-pic?handle=naval" \
  -H "Authorization: Bearer psk_live_..."

JavaScript

const res = await fetch("https://crmsolid.com/data-api/v2/tools/profile-pic?handle=naval", {
  headers: {
    Authorization: `Bearer ${process.env.CRM_SOLID_DATA_API_KEY}`,
  },
});

if (!res.ok) {
  const { error } = await res.json();
  throw new Error(`${error.code}: ${error.message} (${error.request_id})`);
}

const { data, meta } = await res.json();

Python

import os

import requests

res = requests.get(
    "https://crmsolid.com/data-api/v2/tools/profile-pic?handle=naval",
    headers={"Authorization": f"Bearer {os.environ['CRM_SOLID_DATA_API_KEY']}"},
    timeout=30,
)
res.raise_for_status()

payload = res.json()
data, meta = payload["data"], payload["meta"]

Keys look like psk_live_... for production keys, psk_test_... for test keys and are minted in the panel.

What comes back

Success is { data, meta }. Failure is { error: { code, message, request_id } }. The body below is the spec's own example: the values in it are illustrative readings, not live numbers.

Handle: naval
Avatar url: https://pbs.twimg.com/profile_images/1256841238298292232/ycqwaMI2.jpg
Found: yes

200 GET /tools/profile-pic

{
  "data": {
    "handle": "naval",
    "avatar_url": "https://pbs.twimg.com/profile_images/1256841238298292232/ycqwaMI2.jpg",
    "found": true
  },
  "meta": {
    "request_id": "req_9f2c41a8b3d5",
    "generated_at": "2026-08-23T09:14:02.317Z",
    "took_ms": 42,
    "cache_age_s": 0
  }
}

The meta block

request_idstringrequired
Unique id for this request. Quote it in a support ticket.
generated_atstringrequired
Server time the response was produced.
took_msintegerrequired
Milliseconds spent server-side.
pagePageoptional
sourcestringoptional
Which backend served the payload, for endpoints with more than one.
cache_age_sintegeroptional
Age of the underlying data in seconds. 0 for live reads.

When it fails

GET /tools/profile-pic documents 7 failure statuses. Branch on error.code, which is stable and enumerated; message is prose and may change.

401Unauthorizedunauthorized | invalid_key
No key was presented, or the key is unknown, revoked or expired.
402PaymentRequiredpayment_required | subscription_inactive
The key is valid but the plan behind it cannot serve the call: the included requests are spent and overage is switched off, capped or unfunded (payment_required), or the billing period lapsed and was not renewed (subscription_inactive). Retrying does not help; paying does. The X-Plan-* headers on this response say how far past the line you are.
Carries X-Plan, X-Plan-Limit, X-Plan-Overage, X-Plan-Period-End, X-Plan-Remaining.
403Forbiddenforbidden_scope | forbidden_ip
The key is valid but not allowed to make this call: it lacks the scope, or the request came from an address outside the key's allowlist.
422InvalidRequestinvalid_request
A parameter is malformed, out of range or mutually exclusive with another. `details` names the offending fields.
429RateLimitedrate_limited | quota_exceeded
Either the burst ceiling for the current minute or the daily quota is spent. Distinguish with the code: rate_limited clears within the minute, quota_exceeded does not clear until 00:00 UTC.
Carries Retry-After, X-Quota-Limit, X-Quota-Remaining, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Request-Id.
500InternalErrorinternal_error
Something failed on our side. Internals are never leaked; quote the request id.
503Unavailableupstream_timeout | upstream_error | not_configured
The request could not be served right now. BRANCH ON error.code, not on the status: 'upstream_timeout' means a source was too slow (this is what a catalog query hitting its 15-second statement timeout returns, so it is reachable from any endpoint that reads the corpus, not only the live-scrape ones) and the same call is worth retrying with backoff - narrowing it with a smaller limit, a filtered scope or a less popular account makes it far less likely; 'upstream_error' means a source was unreachable, so back off further; 'not_configured' means the capability has no backing service in this deployment, and retrying will never help.

Every response carries X-Request-Id and meta.request_id. Quote it in support requests.

Coverage and limits

This endpoint covers X. Rate limits come from the tier on your key.

X

Tier	Requests a minute	Requests a day	Live reads a minute
free	30	1,000	5
standard	120	25,000	20
pro	600	250,000	60
unlimited	6,000	10,000,000	600

Live reads count against the live column as well as the ordinary one, so a burst of them runs out of the live bucket first. Every response reports where you stand in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and the X-Plan headers.

The rest of the Tools group

The analysis tools behind the public free-tool pages, callable directly: valuation, follower audit, scoring and the rest. Metered like a live call, because each run costs compute or an upstream fetch.

Other groups

Accounts Directory X People Live scrape Insights Trends Identity Graph Watch Research Leads

Start calling it

A key takes a minute to mint in the panel, no card. The reference covers authentication, the envelope, scopes, rate limits and every error code in one page.

Get a key All 127 endpoints Full reference What the Data API is

Reference path: /data-api/reference/tools-profile-pic