The challenge
Instagram's internal GraphQL rejects requests that don't look exactly like browser traffic - missing X-FB-LSD, wrong sec-ch-ua, stale doc_id all fail.
The solution
A single-CLI Python script that detects URL type and follows the correct API chain: for profiles, seed the session via /username/ HTML to extract LSD+cookies, then call web_profile_info/ (REST) with PolarisProfilePageContentQuery (GraphQL) as 429 fallback. For posts/reels, PolarisProfilePostsQuery with cursor pagination. For individual posts/reels, raw HTML + no-auth oEmbed. Cookie input via string or JSON for >12 pagination.
Results
4
URL types
Anonymous / Cookies
Auth modes
REST → GraphQL
Fallback
Headless (requests)
Runtime