OSINT-Cheat-sheet/Script/SOCMINT-Twitter/templates/_field_glossary.html

<!---- SKELETON SECTION DATA -->

<div class="param-heading">Identity</div>
<div class="param-row"><code class="param-key">id / user_id</code> Twitter's internal numeric ID for the tweet / account</div>
<div class="param-row"><code class="param-key">user / screen_name</code> The @handle</div>
<div class="param-row"><code class="param-key">name</code> Display name</div>
<div class="param-row"><code class="param-key">avatar / banner</code> Profile photo / cover photo — direct CDN links, cookie mode only. On a tweet/reply record these are the <em>author's</em> photos, named <code class="param-key">user_avatar</code>/<code class="param-key">user_banner</code> instead so they don't collide with the tweet's own fields</div>

<div class="param-heading">Content</div>
<div class="param-row"><code class="param-key">text / full_text / article_text</code> The post's own complete text — cookie mode always resolves the real full text even for long-form "Note" tweets that X itself truncates in its legacy API field</div>
<div class="param-row"><code class="param-key">reply_to_mentions</code> The @handles X auto-prepended to a reply's text when it was composed (everyone already tagged in that conversation) — x.com's own UI hides these from the visible tweet body and shows them as a separate "Replying to" line instead, which is exactly what every card/panel here does with this field too. The raw <code class="param-key">text</code> itself still contains them untouched</div>
<div class="param-row"><code class="param-key">hashtags</code> Hashtags used in the post</div>
<div class="param-row"><code class="param-key">description</code> Profile bio (a user/follower/following record), or Google's own SERP snippet for that result (a CSE record) — which one depends on whether the record is a person or a web result</div>
<div class="param-row"><code class="param-key">created_at</code> When the <em>post itself</em> was actually made. Same field, every source: Cookie/Xquik get it straight from the API; Wayback and Google CSE decode it from the tweet id's Snowflake bits whenever the result links to a tweet permalink (absent otherwise — e.g. a profile page or a non-X result, where there's no post id to decode)</div>
<div class="param-row"><code class="param-key">fetched_at</code> When <em>this tool</em> pulled the record — same field, every source (Cookie, Xquik, Wayback, Google CSE), so results are comparable side by side. Not to be confused with <code class="param-key">created_at</code> (the post's own creation time) or <code class="param-key">iso_date</code> (a Wayback snapshot's capture time)</div>

<div class="param-heading">Engagement</div>
<div class="param-row"><code class="param-key">reply_count / retweet_count / favorite_count / view_count</code> Counts reported by Twitter (can under-report)</div>

<div class="param-heading">Profile stats</div>
<div class="param-row"><code class="param-key">followers_count / following_count / tweet_count</code> Account stats at fetch time</div>

<div class="param-heading">Verification</div>
<div class="param-row"><code class="param-key">verified</code> Legacy blue checkmark (pre-2023)</div>
<div class="param-row"><code class="param-key">is_blue_verified</code> Paid X Premium checkmark</div>

<div class="param-heading">Threading &amp; retweets</div>
<div class="param-row"><code class="param-key">in_reply_to_tweet_id</code> Parent tweet this replies to — also the drill-down anchor that fetches its replies</div>
<div class="param-row"><code class="param-key">retweeted_text / retweeted_by_user / retweeted_by_name / retweeted_by_bio</code> Content and author of the original tweet being retweeted</div>
<div class="param-row"><code class="param-key">retweeted_at / retweeted_tweet_id</code> When the original was posted, and its own ID</div>
<div class="param-row"><code class="param-key">quoted_text / quoted_user / quoted_name</code> Content and author of the tweet being quoted, when the record itself is a quote-tweet (retweet-with-comment) — the record's own <code class="param-key">text</code> is the quoting user's added commentary, this is what it's commentary <em>on</em></div>
<div class="param-row"><code class="param-key">quoted_at / quoted_tweet_id</code> When the quoted tweet was posted, and its own ID</div>

<div class="param-heading">Media &amp; links (every source)</div>
<div class="param-row"><code class="param-key">media</code> Photo/video attachments — normalized to <code class="param-key">[{type, thumb, url}]</code> regardless of whether the source was Cookie or Xquik/API (the two use different raw shapes internally, unified before display/archive)</div>
<div class="param-row"><code class="param-key">archived_media</code> Local file paths once a result's media has actually been downloaded into an archive — archive view only</div>
<div class="param-row"><code class="param-key">tweet_url</code> Cookie/Xquik: direct link to the tweet, built from user + id. Populated the moment a result is fetched — the same value on the live card, in a JSON dump, and in an archive of it, not built separately each time. Wayback and Google CSE carry their own equivalent instead — see <code class="param-key">archive_url</code>/<code class="param-key">original</code> and <code class="param-key">result_url</code> below</div>

<div class="param-heading">Location</div>
<div class="param-row"><code class="param-key">lat / lon / place</code> Coordinates plotted on the map view (Geo Post Search)</div>
<div class="param-row"><code class="param-key">user_location</code> Free-text profile location string, geocoded client-side to produce lat/lon</div>

<div class="param-heading">Account age (forensics)</div>
<div class="param-row"><code class="param-key">account_created / account_age</code> Derived from the account's numeric ID, not the API — see the Account age badges above</div>
<div class="param-row"><code class="param-key">account_age_flag</code> New / Recent / Established bucket, drives the badge color</div>
<div class="param-row"><code class="param-key">account_age_precision</code> exact (true Snowflake decode) / estimated (pre-Snowflake id, interpolated) / unknown</div>

<div class="param-heading">Archive &amp; Wayback</div>
<div class="param-row"><code class="param-key">archive_url</code> Link to the Wayback Machine snapshot</div>
<div class="param-row"><code class="param-key">iso_date</code> When that snapshot was captured</div>
<div class="param-row"><code class="param-key">original</code> The original URL that was archived</div>
<div class="param-row"><code class="param-key">statuscode / mimetype / length</code> HTTP status / content type / size of the snapshot</div>
<div class="param-row"><code class="param-key">post_title / post_text / preview_image</code> Scraped from the archived page's own meta tags (og:/twitter: tags, or &lt;title&gt;/&lt;meta name="description"&gt; on older captures)</div>

<div class="param-heading">Google CSE / Wayback</div>
<div class="param-row"><code class="param-key">content_type</code> What kind of X/Twitter page a result actually is — <code class="param-key">tweet</code> (a specific permalink) / <code class="param-key">profile</code> (a bare profile page) / <code class="param-key">twitter_other</code> (some other X page) / <code class="param-key">other</code> (a non-X site, Google CSE only). Derived purely from the result URL's own shape — a keyword match isn't always a specific tweet, and this is how to tell without opening the link</div>
<div class="param-row"><code class="param-key">serp_title</code> Google's own SERP result title — always kept as-is, even if <code class="param-key">post_title</code> below gets replaced by a fresher live fetch</div>
<div class="param-row"><code class="param-key">description</code> Google's own SERP snippet for this result — Google truncates this itself (ends mid-sentence in "…"), that's not this tool cutting it short. Kept untouched alongside <code class="param-key">post_text</code> below since a live re-fetch of an X link often gets a less specific, bot-facing page instead</div>
<div class="param-row"><code class="param-key">post_title / post_text</code> "Best known" title/description — starts as Google's own SERP values, replaced by a live fetch of the page's own og:/twitter:/meta tags when one succeeds. See <code class="param-key">serp_title</code>/<code class="param-key">description</code> above for what Google originally had, in case the live fetch made things worse rather than better</div>
<div class="param-row"><code class="param-key">result_url</code> The live page Google indexed, shown as its full raw address</div>
<div class="param-row"><code class="param-key">display_link</code> The result's domain, as shown in Google's own results</div>
<div class="param-row"><code class="param-key">preview_image</code> Thumbnail — from Google's own indexed metadata, or the live page's og:/twitter:image when Google didn't have one</div>

<div class="param-heading">Source</div>
<div class="param-row"><code class="param-key">source</code> Which of the 4 data sources this result came from — Twitter Cookie / Xquik API / Wayback Machine / Google CSE (Multi-Source Search only)</div>

<div class="param-heading">Graph node types (graph page only)</div>
<div class="param-row"><code class="param-key">Search root</code> The diamond node — the query you ran</div>
<div class="param-row"><code class="param-key">Tweet</code> A tweet/post returned by search, by Expand Posts on a user node, or by expanding another node</div>
<div class="param-row"><code class="param-key">Reply</code> A tweet fetched via Expand Replies on a tweet node</div>
<div class="param-row"><code class="param-key">User / Retweeter</code> A person — from Follower/Following Explorer, via Expand Retweets/Followers/Following on a node, or via View Author Profile on a tweet/reply (pulled from that tweet's already-fetched author info, no extra request). Once on canvas, select it and Expand Posts/Followers/Following works the same regardless of how it got there</div>
<div class="param-row"><code class="param-key">Wayback snapshot</code> An archived-page result, from Wayback Archive Search or the Wayback portion of Multi-Source Search</div>
<div class="param-row"><code class="param-key">Web result</code> A Google CSE result, from the Google CSE portion of Multi-Source Search</div>
<div class="param-row"><code class="param-key">Viewed</code> Turns a node solid white once you've clicked it — a visual "already looked at this" marker, not part of the underlying data</div>