A Xiaohongshu profile's posts as logged-out visitors see them (the first 30 or so): title, type, cover, likes, pinned flag, publish date and xsec_token. Xiaohongshu leaves out the note ids in this list for visitors (note_id and url are null), and lists further posts to logged-in accounts only, so next_cursor is always null. Xiaohongshu only opens a profile with the xsec_token that comes with its link (the site adds it to every link it shows: feeds, share links, the url fields of our responses). Pass the whole link as url, or the id with xsec_token.
Every response includes credits_used: the credits this call cost.
Parameters
name
type
description
url
string
A xiaohongshu.com profile link with its xsec_token (user/profile/<id>?xsec_token=...). Example: https://www.xiaohongshu.com/user/profile/55e34cd858944675eb95b706?xsec_token=AB7AqOdnHoTVkdlz_g1V63r0auJqJxW83__3LrOYDVXTw=&xsec_source=pc_feed
user_id
string
User id (24 hex characters), with xsec_token, instead of url.
xsec_token
string
The profile's xsec_token (from the link), with user_id.
import os, requests
res = requests.get(
"https://api.api.sh/xiaohongshu/v1/user/notes",
params={"url": "https://www.xiaohongshu.com/user/profile/55e34cd858944675eb95b706?xsec_token=AB7AqOdnHoTVkdlz_g1V63r0auJqJxW83__3LrOYDVXTw=&xsec_source=pc_feed"},
headers={"x-api-key": os.environ["APISH_KEY"]},
timeout=120,
)
res.raise_for_status()
data = res.json()
const url = new URL("https://api.api.sh/xiaohongshu/v1/user/notes");
url.searchParams.set("url", "https://www.xiaohongshu.com/user/profile/55e34cd858944675eb95b706?xsec_token=AB7AqOdnHoTVkdlz_g1V63r0auJqJxW83__3LrOYDVXTw=&xsec_source=pc_feed");
const res = await fetch(url, { headers: { "x-api-key": process.env.APISH_KEY } });
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
const data = await res.json();
Response
A JSON object with the fields described above, plus raw (the source's own data), cached, fetched_at and credits_used. Errors return {"success": false, "error": "…"} with the HTTP status (see errors). A lookup that ran but found nothing (404) costs the price above; refused calls and errors on our side are free (what's charged).
The fastest way to see the full response is the playground: it runs this endpoint with your account and shows the exact JSON.