Apple Ads Platform API vs X Ads API

Apple Ads Platform API

Every response carries RateLimit-* headers and a 429 carries Retry-After, Apple maintains MIT client libraries in four languages, and read-only API roles exist. The API was first released in August 2026. No status page, SLA, published OpenAPI file, idempotency key or test account was found, and a person must create the credentials in the Apple Ads interface.

X Ads API

Rate limits are published per endpoint type, a sandbox host never serves ads, and the X Ads MCP server has separate read and write scopes and creates campaigns paused. The REST API needs OAuth 1.0a signing and an approved app, no OpenAPI file covers it, and the official Python and Ruby SDKs were last released in May 2022.

Apple Ads Platform API

1. Send Authorization: Bearer {access_token} and X-AP-Context: adAccountId={adAccountId} on every ad account call. Get the account id from GET /v1/acls
2. Request a new access token every 3,600 seconds from https://appleid.apple.com/auth/oauth2/token with scope searchadsorg. The signed client secret lasts at most 180 days
3. Read RateLimit-Remaining on each response. On a 429 wait the Retry-After seconds, then double the wait up to 16 seconds
4. List and filter with POST to a /query endpoint, not GET with query parameters. Deleted entities return only when a filter asks for them
5. On PUT send only the fields to change, and send the complete desired array for any array field. Create campaigns with "status": "PAUSED" before review

X Ads API

1. Build against https://ads-api-sandbox.x.com/12/ first. Create a test account with POST accounts and a funding instrument there before touching a live account
2. On HTTP 429 wait until the time in x-rate-limit-reset. On 503 wait for retry-after. The docs say apps that ignore these can be throttled or lose access without notice
3. Read the account-level limit from x-account-rate-limit-* when present and use x-rate-limit-* only when it is absent
4. For a read-only MCP session request ads.read offline.access only. Without offline.access the token expires in about two hours with no refresh
5. Page with count (1 to 1,000, default 200) and cursor until next_cursor is null. Analytics endpoints page by time range instead, and with_total_count cannot be combined with cursor