pulbi

PULBI API

A link in.A file out.

Media extraction for TikTok, X, YouTube, Instagram and Facebook. Metadata as JSON, file via a temporary URL. Private pre-alpha: not deployed and not an SLA.

Read the docs
  • Works with the HTTP client you already use
  • No origin session cookie reaches your side
  • Invite-only while we are in pre-alpha
fetch
const response = await fetch('https://api.pulbi.app/v1/extract', {
  method: 'POST',
  headers: {
    authorization: 'Bearer pulbi_live_<16-hex>.<43-base64url>',
    'content-type': 'application/json',
  },
  body: JSON.stringify({ url: 'https://example.invalid/x/status/1' }),
});

There is no @pulbi/sdk. Use curl or fetch.

Start with your key

Start with your key

The operator issues the key. The secret is shown once. There is no self-signup.

  1. 1Request access and say which platforms you need
  2. 2Create the key in the dashboard when self-service exists. Until then the operator issues it.
  3. 3Point the base URL at api.pulbi.app and call /v1/extract

Platforms and formats

The matrix below is dated evidence, not a commercial catalogue. None of this is deployed.

TikTok

tiktok

Video, photo carousel

Not required in public mode

Local live 2026-09-06. Not deployed.

X

twitter

Video, GIF, photo, multiple images

Not required in public mode

Local live 2026-09-06. Not deployed.

YouTube

youtube

Video, Short — requires_mux in the response

Not required in public mode

Local live 2026-09-06 (mux). Not deployed.

Instagram

instagram

Public Reels via public_proxy; authenticated Stories/posts blocked

Cookies are refused in the product

Reel live-tested 2026-09-10. No SLA.

Facebook

facebook

Public Reels via public_proxy; shares/photos outside this canary

Cookies are refused in the product

Reel live-tested 2026-09-10. No SLA.

Pinterest

pinterest

Strategies present; no approved live case

Not commercially operational

Not executed.

What the response carries

Variants with resolution and size

Pick quality before download, without guessing from the filename.

Temporary delivery URL

Edge path token, Range, use count and expiry. The host is EDGE_BASE_URL, not an invented domain.

Notice when audio is missing

The requires_mux response field tells you video and audio arrived separately.

Jobs with idempotency

Assemble returns queued/active/completed/failed/canceled. There is no expired in the public JSON.

Slideshow assembly

Images plus audio become a single MP4 via POST /v1/assemble when the contract requires it.

Errors that say what to do

Each code says whether to retry and how long to wait. 401 is only the PulbiAPI key.

Our session cookie never reaches your side

Public Instagram and Facebook Reels use public_proxy, with no cookies. Authenticated Stories and posts are blocked (platform_auth_required / unsupported_content). Operator-only identities are not product.

How it works
Encrypted at rest
Operator-only identities use AES-256-GCM. Public Reels mode carries no cookies.
Private content refused
When unsure we return 403 (private_content / privacy_undetermined / platform_auth_required).
Hashed URLs
We store the hash, never the URL in the clear, with retention applied in code.
No durable storage
Files do not stay with us. Muxed output expires with the delivery token.
SSRF defences
Allowlist, DNS pinned at connect time, and revalidation on every redirect.
Content removal
The removal channel is planned. The /remocao page states the pending legal copy.

Choose how to start

Build it yourself

One key, the docs, and the dashboard when it exists.

  • Docs with copyable curl/fetch examples
  • Operator-issued key while self-service does not exist
  • Preview dashboard, no invented telemetry
Read the docs

Talk to us

For high volume or platforms that consume identity.

  • Public FB/IG Reels via public_proxy, no cookies
  • Authenticated Stories/posts are not product
  • Billing and SLA are planned, not for sale