From 8493a9f3f3085c8ce64dbd38d0eb37abf152a4b7 Mon Sep 17 00:00:00 2001 From: Sweets Sweetman Date: Fri, 3 Jul 2026 13:49:40 -0500 Subject: [PATCH 1/2] docs(social): account-scoped Scraper Results auth + scrape persistence note (chat#1840) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GET /api/apify/runs/{runId} is moving from admin-only to owner-or-admin: the account that started the run via POST /api/socials/{id}/scrape can poll it. Document the new 403 (foreign run, non-admin) and 404 (no recorded owner, non-admin) responses and the ownership rules in the description. Runs with no recorded owner (pre-tracking, or started from other endpoints) stay admin-only. Also note on Social Scrape that completed runs persist profile stats, and post URLs on Instagram/TikTok/X — surfaced via Get Artist Posts. Contract for recoupable/chat#1840 (both items); api PRs follow. Co-Authored-By: Claude Fable 5 --- api-reference/openapi/social.json | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/api-reference/openapi/social.json b/api-reference/openapi/social.json index 4cb54f2..24523df 100644 --- a/api-reference/openapi/social.json +++ b/api-reference/openapi/social.json @@ -482,7 +482,7 @@ }, "/api/apify/runs/{runId}": { "get": { - "description": "Check the status and retrieve results from Apify scraper runs. This endpoint uses the Apify API Client to fetch the current status of a scraper run and its results if available. Use the runId returned from endpoints like Instagram Comments, Instagram Profiles, Social Scrape, or Artist Socials Scrape to poll for results.", + "description": "Check the status and retrieve results from Apify scraper runs. This endpoint uses the Apify API Client to fetch the current status of a scraper run and its results if available. Use the runId returned from endpoints like Instagram Comments, Instagram Profiles, Social Scrape, or Artist Socials Scrape to poll for results. Authorization is account-scoped: the account that started the run via the [Social Scrape](/api-reference/social/scrape) endpoint (or an admin) can poll it. Runs started by other accounts return 403; run ids with no recorded owner — including runs started before ownership tracking existed and runs started from other endpoints — return 404 for non-admin callers.", "parameters": [ { "name": "runId", @@ -523,6 +523,26 @@ } } }, + "403": { + "description": "Forbidden - the run belongs to a different account and the caller is not an admin", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ApifyScraperErrorResponse" + } + } + } + }, + "404": { + "description": "Not found - no recorded owner for this run id (non-admin callers only; admins can poll any run id)", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ApifyScraperErrorResponse" + } + } + } + }, "500": { "description": "Server error - failed to fetch run status from Apify", "content": { @@ -538,7 +558,7 @@ }, "/api/socials/{id}/scrape": { "post": { - "description": "Trigger a social profile scraping job for a given social profile. Use the [Get Artist Socials](/api-reference/artists/socials) endpoint first to retrieve the social profile id values. The response returns run metadata for polling status and retrieving results via the [Scraper Results API](/api-reference/apify/scraper).", + "description": "Trigger a social profile scraping job for a given social profile. Use the [Get Artist Socials](/api-reference/artists/socials) endpoint first to retrieve the social profile id values. The response returns run metadata for polling status and retrieving results via the [Scraper Results API](/api-reference/apify/scraper). Completed runs also persist the scraped profile stats (follower/following counts, avatar, bio) to the social row, and on Instagram, TikTok, and X/Twitter the scraped post URLs are saved and appear in [Get Artist Posts](/api-reference/posts/get).", "parameters": [ { "name": "id", From 4ac7067cf6d2bbd46f767824eeb4def4c0b94eed Mon Sep 17 00:00:00 2001 From: Sweets Sweetman Date: Fri, 3 Jul 2026 14:44:20 -0500 Subject: [PATCH 2/2] rework: any authenticated caller can poll scraper runs (chat#1840 decision) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Design decision 2026-07-03: scrape datasets are public social content and Apify run ids are unguessable, so possession of a runId plus any valid API key / Bearer token is sufficient — no ownership scoping. Drops the 403/404 responses; keeps the authentication requirement and the scrape persistence note. Co-Authored-By: Claude Fable 5 --- api-reference/openapi/social.json | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/api-reference/openapi/social.json b/api-reference/openapi/social.json index 24523df..bb9d842 100644 --- a/api-reference/openapi/social.json +++ b/api-reference/openapi/social.json @@ -482,7 +482,7 @@ }, "/api/apify/runs/{runId}": { "get": { - "description": "Check the status and retrieve results from Apify scraper runs. This endpoint uses the Apify API Client to fetch the current status of a scraper run and its results if available. Use the runId returned from endpoints like Instagram Comments, Instagram Profiles, Social Scrape, or Artist Socials Scrape to poll for results. Authorization is account-scoped: the account that started the run via the [Social Scrape](/api-reference/social/scrape) endpoint (or an admin) can poll it. Runs started by other accounts return 403; run ids with no recorded owner — including runs started before ownership tracking existed and runs started from other endpoints — return 404 for non-admin callers.", + "description": "Check the status and retrieve results from Apify scraper runs. This endpoint uses the Apify API Client to fetch the current status of a scraper run and its results if available. Use the runId returned from endpoints like Instagram Comments, Instagram Profiles, Social Scrape, or Artist Socials Scrape to poll for results. Requires authentication: any valid API key or Bearer token can poll any run id — scrape results are public social content and run ids are unguessable, so possession of a runId plus a valid credential is sufficient.", "parameters": [ { "name": "runId", @@ -523,26 +523,6 @@ } } }, - "403": { - "description": "Forbidden - the run belongs to a different account and the caller is not an admin", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/ApifyScraperErrorResponse" - } - } - } - }, - "404": { - "description": "Not found - no recorded owner for this run id (non-admin callers only; admins can poll any run id)", - "content": { - "application/json": { - "schema": { - "$ref": "#/components/schemas/ApifyScraperErrorResponse" - } - } - } - }, "500": { "description": "Server error - failed to fetch run status from Apify", "content": {