xdevplatform · mintlify · Jun 9, 2026
diff --git a/developer-guidelines.mdx b/developer-guidelines.mdx
@@ -31,22 +31,22 @@ icon: "scale-balanced"
 Before building, ask yourself these questions. If you answer **"no"** to any of them, your app likely violates X's policies.
 
 <CardGroup cols={2}>
-  <Card title="User Initiated?" icon="hand-pointer">
+  <Card title="User-initiated?" icon="hand-pointer">
     For interactions, did the user **explicitly request** it?
   </Card>
   <Card title="Transparent?" icon="tag">
     Is your app's purpose and behavior **clear to users**? (Automated accounts must be labeled.)
   </Card>
-  <Card title="Easy Opt-Out?" icon="right-from-bracket">
+  <Card title="Easy opt-out?" icon="right-from-bracket">
     Can users **easily opt out** of any ongoing interactions?
   </Card>
-  <Card title="Real Value?" icon="gem">
+  <Card title="Real value?" icon="gem">
     Does it provide **real value** beyond self-promotion?
   </Card>
-  <Card title="Official API Only?" icon="code">
+  <Card title="Official API only?" icon="code">
     Are you **only using the official API** (not scraping/browser automation)?
   </Card>
-  <Card title="Within Limits?" icon="gauge">
+  <Card title="Within limits?" icon="gauge">
     Are you **within rate limits** and respecting usage policies?
   </Card>
 </CardGroup>
@@ -62,7 +62,7 @@ Before building, ask yourself these questions. If you answer **"no"** to any of
 Real-world examples to help you understand what's permitted. **These rules apply to all apps**—whether you're building a bot, mobile app, web integration, browser extension, analytics dashboard, or any other tool that uses the X API.
 
 <Tabs>
-  <Tab title="Content & Posting">
+  <Tab title="Content & posting">
     | Scenario | Allowed? | Why |
     |----------|:--------:|-----|
     | Automated account posts scheduled content (news, weather, quotes) | <Icon icon="circle-check" color="#22c55e" /> | Informational, no unsolicited mentions |
@@ -74,7 +74,7 @@ Real-world examples to help you understand what's permitted. **These rules apply
     | App posts to trending topics to gain visibility | <Icon icon="circle-xmark" color="#ef4444" /> | Trend manipulation |
     | Multiple city-specific alert accounts (e.g., @WeatherNYC, @WeatherLA) | <Icon icon="circle-check" color="#22c55e" /> | Allowed—non-duplicative, location-specific content |
   </Tab>
-  <Tab title="Replies & Mentions">
+  <Tab title="Replies & mentions">
     | Scenario | Allowed? | Why |
     |----------|:--------:|-----|
     | App responds to @mentions asking for help | <Icon icon="circle-check" color="#22c55e" /> | User-initiated request |
@@ -107,7 +107,7 @@ Real-world examples to help you understand what's permitted. **These rules apply
 
     <Warning>**Likes must be directly initiated by the authenticated user.** Automated, bulk, or indiscriminate liking — including auto-liking by keyword, hashtag, user, or schedule — is prohibited. Apps may not offer "auto-like" features or sell likes as a service. This applies to all apps—bots, mobile apps, browser extensions, or any integration.</Warning>
   </Tab>
-  <Tab title="Promotions & Commerce">
+  <Tab title="Promotions & commerce">
     | Scenario | Allowed? | Why |
     |----------|:--------:|-----|
     | App sends product recommendations when asked | <Icon icon="circle-check" color="#22c55e" /> | User-initiated |
@@ -116,7 +116,7 @@ Real-world examples to help you understand what's permitted. **These rules apply
     | Service selling likes/follows/retweets | <Icon icon="circle-xmark" color="#ef4444" /> | Strictly prohibited |
     | Tip service that sends crypto when user requests | <Icon icon="circle-check" color="#22c55e" /> | User-initiated—comply with financial regulations. [Conditions apply](#gray-areas-explained) |
   </Tab>
-  <Tab title="Data & Research">
+  <Tab title="Data & research">
     | Scenario | Allowed? | Why |
     |----------|:--------:|-----|
     | App tracks brand mentions for analytics dashboard | <Icon icon="circle-check" color="#22c55e" /> | Valid use case |
@@ -209,7 +209,7 @@ All automated accounts using the X API must meet these requirements:
 Many developers have questions about edge cases. Here's guidance on common gray areas.
 
 <AccordionGroup>
-  <Accordion title="Affiliate Links & Promotions" icon="link">
+  <Accordion title="Affiliate links & promotions" icon="link">
     <Check>
       **Allowed if:**
       - User explicitly requests it (e.g., DMs asking for a recommendation)
@@ -225,7 +225,7 @@ Many developers have questions about edge cases. Here's guidance on common gray
     </Warning>
   </Accordion>
 
-  <Accordion title="AI-Generated Content & Replies" icon="microchip-ai">
+  <Accordion title="AI-generated content & replies" icon="microchip-ai">
     - **Requires prior approval from X** before deployment
     - Must still follow all rules (no unsolicited mentions, properly labeled)
     - Contact X via the [Policy Support form](https://help.x.com/forms/platform) before launching
@@ -234,7 +234,7 @@ Many developers have questions about edge cases. Here's guidance on common gray
     <Warning>Deploying AI-generated replies without approval is a violation, even if the content itself is helpful.</Warning>
   </Accordion>
 
-  <Accordion title="Welcome Messages to New Followers" icon="envelope">
+  <Accordion title="Welcome messages to new followers" icon="envelope">
     **Not allowed** as automated DMs—this counts as unsolicited contact, even though they followed you.
 
     **Alternatives:**
@@ -243,7 +243,7 @@ Many developers have questions about edge cases. Here's guidance on common gray
     - Auto-reply only if they DM you first
   </Accordion>
 
-  <Accordion title="Multiple Accounts / Regional Bots" icon="globe">
+  <Accordion title="Multiple accounts / regional bots" icon="globe">
     <Check>
       **Allowed if:**
       - Each account serves **non-duplicative** purposes (e.g., @EarthquakeJP, @EarthquakeCA)
@@ -258,7 +258,7 @@ Many developers have questions about edge cases. Here's guidance on common gray
     </Warning>
   </Accordion>
 
-  <Accordion title="Customer Support Automation" icon="headset">
+  <Accordion title="Customer support automation" icon="headset">
     <Check>
       **Allowed if:**
       - User initiates (mentions you, DMs you, or explicitly opts in)
@@ -274,7 +274,7 @@ Many developers have questions about edge cases. Here's guidance on common gray
     </Warning>
   </Accordion>
 
-  <Accordion title="Giveaways & Contests" icon="gift">
+  <Accordion title="Giveaways & contests" icon="gift">
     **Proceed with caution:**
     - Requiring follows/retweets as entry can be seen as engagement manipulation
     - Must comply with [X's contest guidelines](https://help.x.com/en/rules-and-policies/x-contest-rules)
@@ -391,14 +391,14 @@ You must delete X Content from your systems when requested:
 Your obligations as a developer:
 
 <AccordionGroup>
-  <Accordion title="Security Requirements" icon="shield">
+  <Accordion title="Security requirements" icon="shield">
     - Use **industry-standard security** practices to protect X data
     - Never share your API credentials or tokens
     - Store credentials securely (environment variables, secret managers—not in code)
     - Implement proper authentication in your apps
   </Accordion>
 
-  <Accordion title="Breach Notification" icon="bell">
+  <Accordion title="Breach notification" icon="bell">
     If you experience a security breach involving X data:
     - **Notify X immediately**
     - Take steps to mitigate the breach
@@ -411,7 +411,7 @@ Your obligations as a developer:
     - Don't use confidential info for competitive purposes
   </Accordion>
 
-  <Accordion title="Audit Rights" icon="magnifying-glass">
+  <Accordion title="Audit rights" icon="magnifying-glass">
     - X may audit your compliance **up to once per year**
     - You must provide reasonable access and documentation
     - Keep records of how you use X data

diff --git a/developer-terms.mdx b/developer-terms.mdx
@@ -11,7 +11,7 @@ import { Button } from '/snippets/button.mdx';
 
 ## Overview
 
-Developer use of X materials and content is subject to and governed by our Developer Policy and agreements.
+Our Developer Policy and agreements govern your use of X materials and content.
 
 <div className="developer-cards-grid grid md:grid-cols-3 gap-6 my-8 auto-rows-fr">
   <Card 

diff --git a/enterprise-api/account-activity/introduction.mdx b/enterprise-api/account-activity/introduction.mdx
@@ -41,7 +41,7 @@ This API is commonly used to build applications that need to react instantly to
 
 ## Activity types
 
-You will receive all related activities below for each user subscription on your webhook registration:
+You'll receive the following activities for each user subscription on your webhook:
 
 - **Posts** (by user)
 - **Post deletes** (by user)

diff --git a/enterprise-api/activity/introduction.mdx b/enterprise-api/activity/introduction.mdx
@@ -23,7 +23,7 @@ The X Activity API currently supports the following delivery mechanisms to send
 
 Currently, X Activity API supports the following event types, organized by category:
 
-### Profile Events
+### Profile events
 
 Profile events are triggered when a user makes changes to their profile information.
 
@@ -39,7 +39,7 @@ Profile events are triggered when a user makes changes to their profile informat
 | `profile.update.verified_badge` | Fired when a user updates their verified badge | `user_id` |
 | `profile.update.affiliate_badge` | Fired when a user updates their affiliate badge | `user_id` |
 
-### Follow Events
+### Follow events
 
 Follow events are triggered when the filtered user follows another user, or is followed by another user.
 
@@ -52,7 +52,7 @@ Follow events are triggered when the filtered user follows another user, or is f
 **Enterprise Only:** The `follow.follow` and `follow.unfollow` events are only available to Enterprise and Partner tier accounts at this time.
 </Note>
 
-### Spaces Events
+### Spaces events
 
 Spaces events are triggered when a user starts or ends a Space.
 
@@ -61,7 +61,7 @@ Spaces events are triggered when a user starts or ends a Space.
 | `spaces.start` | Fired when a user starts a Space | `user_id` |
 | `spaces.end` | Fired when a user ends a Space | `user_id` |
 
-### Post Events
+### Post events
 
 Post events are triggered when a user creates or deletes a Post.
 
@@ -76,7 +76,7 @@ Post events are triggered when a user creates or deletes a Post.
 If you want targeted keyword filtering, boolean logic, geo targeting, language filters, or any of the other operators that the Filtered Stream supports, use the [Filtered Stream](/x-api/posts/filtered-stream/introduction) endpoint instead.
 </Note>
 
-### Legacy DM Events
+### Legacy DM events
 
 Legacy DM events pertain to the legacy, unencrypted DM system.
 
@@ -87,7 +87,7 @@ Legacy DM events pertain to the legacy, unencrypted DM system.
 | `dm.read` | Fired when a user reads the filtered users unencrypted DM message, or "read receipt" | `user_id` |
 | `dm.indicate_typing` | Fired when a user is typing a message to the filtered user | `user_id` |
 
-### Chat Events
+### Chat events
 
 Chat events pertain to the new, encrypted messaging stack, or XChat.
 
@@ -98,7 +98,7 @@ Chat events pertain to the new, encrypted messaging stack, or XChat.
 | `chat.conversation_join` | Fired when a user joins an encrypted chat conversation | `user_id` |
 
 
-### News Events
+### News events
 
 News events provide updates on trending topics and headlines curated by Grok.
 
@@ -116,7 +116,7 @@ In future releases, XAA will expand to support additional event types including
 
 The X Activity API distinguishes between **public events** and **private events** as at parity with the X app as explained below.
 
-### Public Events
+### Public events
 
 Public events are activities that a public user account performs publicly that are visible to all X users. These events are visible to all users on the X platform and don't require OAuth authentication from the user in order to view.
 
@@ -126,7 +126,7 @@ Public events are activities that a public user account performs publicly that a
 
 For these public events, you can create subscriptions by specifying the user ID in your filter and receive them via XAA.
 
-### Private Events
+### Private events
 
 Private events are activities that require explicit user consent through OAuth authentication. A User has to authenticate via X and give explicit permission to a developer app to access these events. 
 

diff --git a/enterprise-api/activity/quickstart.mdx b/enterprise-api/activity/quickstart.mdx
@@ -7,10 +7,10 @@ description: "This guide explains how to subscribe for and receive events using
 
 import { Button } from '/snippets/button.mdx';
 
-This guide explains how to subscribe for and receive events using the X Activity API endpoints. There generally 3 steps involved:
-1. Identify the User ID for the User who's events you want to filter on
-2. Create a subscription for the type of event you want to filter for that User
-3. Receive the events using webhook or persistent http stream connection
+This guide explains how to subscribe for and receive events using the X Activity API endpoints. There are generally three steps:
+1. Identify the user ID for the user whose events you want to filter on.
+2. Create a subscription for the type of event you want to filter for that user.
+3. Receive the events using a webhook or persistent HTTP stream connection.
 
 <Note>
 **Prerequisites**
@@ -139,7 +139,7 @@ When Xdevelopers account updates their profile bio, the event will be delivered
 
 The X Activity API provides endpoints to manage your subscriptions through standard CRUD operations.
 
-### Create Subscription
+### Create subscription
 
 Create a new subscription to receive events:
 
@@ -180,7 +180,7 @@ curl -H "Authorization: Bearer YOUR_BEARER_TOKEN" \
 }
 ```
 
-### List Subscriptions
+### List subscriptions
 
 Retrieve all active subscriptions for your application:
 
@@ -219,7 +219,7 @@ curl -H "Authorization: Bearer YOUR_BEARER_TOKEN" \
 }
 ```
 
-### Delete Subscription
+### Delete subscription
 
 Remove a subscription:
 
@@ -244,7 +244,7 @@ curl -H "Authorization: Bearer YOUR_BEARER_TOKEN" \
 
 `total_subscriptions` shows the remaining number of subscriptions associated with your app after the delete operation.
 
-### Update Subscription
+### Update subscription
 
 The PUT endpoint allows you to update a subscription's delivery method or tag.
 

diff --git a/enterprise-api/webhooks/quickstart.mdx b/enterprise-api/webhooks/quickstart.mdx
@@ -161,7 +161,7 @@ def webhook():
 
 X's webhook-based APIs provide two methods for confirming the security of your webhook server:
 
-### Challenge-Response Check (CRC)
+### Challenge-response check (CRC)
 
 The CRC enables X to confirm ownership of the web app receiving webhook events. See [Step 2](#2-the-crc-check) above for full implementation details.
 

diff --git a/fundamentals/authentication/basic-auth.mdx b/fundamentals/authentication/basic-auth.mdx
@@ -12,7 +12,7 @@ Many of X's enterprise APIs require the use of HTTP Basic Authentication. To mak
 
 When building a request using Basic Authentication, make sure you add the Authentication: Basic HTTP header with encoded credentials over HTTPS.
 
-In the following cURL request example, you would replace `<email_address>` and `<password>` with your credentiails before sending the request:
+In the following cURL request example, you would replace `<email_address>` and `<password>` with your credentials before sending the request:
 
 ```bash
 curl -v --compressed -u<email_address>:<password>

diff --git a/fundamentals/authentication/faq.mdx b/fundamentals/authentication/faq.mdx
@@ -24,7 +24,7 @@ description: Answers to common questions about OAuth 1.0a, OAuth 2.0, access tok
 ## Technical
 <AccordionGroup>
   <Accordion title="How long does an access token last?">
-  Access tokens are not explicitly expired. An access token will be invalidated if a user explicitly revokes an application in the their X account settings, or if X suspends an application. If an application is suspended, there will be a note in the [X app](/resources/fundamentals/developer-apps) dashboard stating that it has been suspended.
+  Access tokens are not explicitly expired. An access token will be invalidated if a user explicitly revokes an application in their X account settings, or if X suspends an application. If an application is suspended, there will be a note in the [X app](/resources/fundamentals/developer-apps) dashboard stating that it has been suspended.
   </Accordion>
   <Accordion title="What if an access token becomes invalid?">
   Assume a user’s access token _may_ become invalid at any time. If this happens, prompt the user to re-authorize the application. Ensuring that this situation is handled gracefully is important for a good user experience.

diff --git a/fundamentals/authentication/oauth-1-0a/oauth-echo.mdx b/fundamentals/authentication/oauth-1-0a/oauth-echo.mdx
@@ -32,7 +32,7 @@ Keep in mind that the entire transaction period needs to occur within an amount
 
 Alternatively, instead of sending these two parameters in the header, they could be sent in the POST as x\_auth\_service_provider and x\_verify\_credentials_authorization — in this case, remember to escape and include the parameters in the OAuth signature base string — similar to encoding parameters in any request. It’s best to use HTTP headers to keep the operations as separate as possible.
 
-The Delegators goal, at this point, is to verify that the User is who they say they are before it saves the media. Once the Delegator receives all the data above via its upload method, it should temporarily store the image, and then construct a call to the endpoint specified in the x-auth-service-provider header — in this case, https://api.x.com/1.1/account/verify_credentials.json, using the same OAuth authentication header provided by the Consumer in the x-verify-credentials-authorization header.
+The Delegator's goal, at this point, is to verify that the User is who they say they are before it saves the media. Once the Delegator receives all the data above via its upload method, it should temporarily store the image, and then construct a call to the endpoint specified in the x-auth-service-provider header — in this case, https://api.x.com/1.1/account/verify_credentials.json, using the same OAuth authentication header provided by the Consumer in the x-verify-credentials-authorization header.
 
 
 #### OAuth Echo best practices