# Build brief — a focused alternative to HikerAPI > **Verdict:** Not faithfully · **Buildability:** 14/100 · **Category:** Dev Tools > **Source:** https://www.canitbevibecoded.com/hikerapi > Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from HikerAPI. Verify current pricing and capabilities before acting. ## Context **HikerAPI** — A pay-per-request API for Instagram data: profiles, posts, followers, hashtags, stories, without touching the official platform APIs. The code here is the easy part: instagrapi and friends are open source, and an agent can wrap them in a REST API with a focused implementation. What you cannot one-shot is a farm of aged accounts, residential proxy rotation, fingerprint churn, and a team that patches the client every time Instagram quietly changes an internal endpoint or ships a new challenge flow. Your single account behind your home IP will hit rate limits, then checkpoints, then a permanent ban, usually in that order and usually on the day you need data. A personal build is fine for pulling a few hundred profiles once. It is not fine for anything that has to keep working next month. This brief describes a focused, single-operator replacement for the part of HikerAPI that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest. ## What you are building A local FastAPI service that wraps instagrapi with one logged-in session, a proxy, aggressive request pacing, and a SQLite cache so you never fetch the same profile twice. - Build the focused developer workflow you use repeatedly, with local configuration. - A responsive interface with real empty, loading, success, and error states. ## Requirements ### Functional - A throwaway Instagram account you are willing to lose. - A residential or mobile proxy, datacenter IPs get flagged fast. - Python 3.11 and patience for session challenge prompts. - Acceptance that any of this can break without warning. ### Non-functional - Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support. - Security: server-side secrets, validated input, and no credentials in the client bundle. - Reliability: retries with backoff on external calls, and a clear failure state when a provider is down. - Portability: the operator can export their data and leave without losing it. ## Implementation brief Build a local, single-user Instagram data service in an empty folder. Stack: Python 3.11, FastAPI, uvicorn, instagrapi, SQLite via sqlite3 (no ORM), httpx only if needed. Goal: a small REST API on localhost that returns Instagram profile, media, and follower data for personal research, with heavy caching so I never fetch the same thing twice. Endpoints: - GET /user/{username} : profile info (id, full name, bio, counts, is_private, profile pic url) - GET /user/{username}/media?limit=N : recent posts (id, code, caption, like/comment counts, taken_at, media urls) - GET /user/{username}/followers?limit=N : follower list, capped at 200 per call - GET /hashtag/{tag}/top : top media for a hashtag - GET /cache/stats : row counts and cache hit counters Rules: - Credentials and proxy come from .env: IG_USERNAME, IG_PASSWORD, IG_PROXY. Ship a .env.example, never commit secrets. - Persist the instagrapi session to session.json and reuse it on boot. Only re-login if the session is dead. - One global request queue with a single worker. Sleep a random 4 to 12 seconds between platform calls. No concurrency, ever. - Cache every response in SQLite keyed by endpoint plus params, with a fetched_at timestamp and a TTL of 24 hours for profiles and 6 hours for media. Serve cache on hit and mark the response with a "cached": true field. - On login challenge, 429, or ChallengeRequired, return HTTP 503 with a clear message telling me to log in manually in a browser on the same proxy. Do not retry in a loop. - Log every platform call to a requests table so I can see exactly how much I hammered them. Out of scope: no posting, liking, following, or DMs. No web UI beyond FastAPI's built-in docs. No account rotation, no proxy pool, no cloud deploy, no telemetry. Deliverables: main.py, db.py, client.py, .env.example, requirements.txt, and a README that says plainly that this account will probably get banned and that the TTLs and sleeps are the only thing keeping it alive. ## Delivery standard - Inspect the repository first, then write a short implementation plan before writing code. - Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data. - Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations. - Include responsive layouts plus genuine empty, loading, success, validation, and failure states. - Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data. - Add structured logs around every external call and return actionable errors without leaking sensitive details. - Write unit tests for the core logic and one automated test of the main user journey. - Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations. ## Acceptance criteria - [ ] A clean install starts the app using only the README and .env.example. - [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable. - [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state. - [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control. - [ ] Tests, type checking, linting, and a production build all pass with no ignored failures. - [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified. ## Non-goals Do not build these, and do not claim to have replaced them: - An account pool that absorbs bans so yours does not. - Residential proxy rotation and device fingerprint management. - Same-day fixes when the platform changes internal endpoints. - Real throughput: concurrent requests instead of one polite call every few seconds. - Coverage beyond Instagram, including TikTok and other networks. ## What you still own after launch - Run migrations, backups, restores, and dependency updates. - Test the critical journey after every model, API, or hosting change. - Monitor failures and fix the edge cases a first prompt will miss. ## Risk **Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost. Editorial confidence in this assessment: medium. No reviewed project implementation is linked yet. --- Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/hikerapi