The scheduler or reply bot works fine. Weeks later, the app gets suspended anyway. Not because an endpoint broke — because nobody enabled the one disclosure setting X’s Automation Rules require before a bot account is allowed to run at all: the “Automated” profile label.
X defines an automated account plainly: an account that performs programmed actions through the X API. The moment a tool posts, replies, or messages without a human typing each action, X classifies it as automated — and automated accounts carry obligations that go well beyond holding valid API credentials. Miss them and the consequence in X’s own Developer Guidelines is stated without qualification: violations can result in app suspension, API access revocation, or permanent account bans.
What the label actually requires
X’s Help Center and Developer Guidelines describe the automated account label as a transparency feature — when an account displays it, anyone interacting with that account knows it is not human-run. Getting there is not cosmetic; it is one line item in a short list of requirements every automated account must satisfy together.
Enable the profile label
The “Automated” label appears under the account name and handle, and may also appear on its posts.
Disclose the operator in bio
State clearly that it is a bot and who runs it — X’s own examples read “Bot by @yourcompany” or “Automated account managed by Example Inc.”
Link a human-managed account
Every automated account must stay connected to a real, human-run account for accountability and contact.
Honor opt-outs immediately
If a user says stop, the bot has to stop — with keyword detection for common opt-out phrasing.
Official API only
No scraping or browser automation. X treats this as a permanent-suspension issue, not a warning-first one.
If any of the account’s replies or posts are AI-generated, the label alone does not clear it. X’s Developer Guidelines require prior approval before an AI-generated-reply bot goes live, requested through X’s Policy Support form — and even once approved, the account still cannot impersonate a human. Teams that ship the label and skip this second approval step are compliant on the profile and still in violation on the content.
What automated actions are allowed once the label is on
The label does not unlock unrestricted automation. X’s Developer Guidelines set per-action rules, and several common patterns — auto-liking, bulk DMs, welcome messages to new followers — stay prohibited no matter how clearly the bot discloses itself.
| Automated action | Allowed? | Condition |
|---|---|---|
| Post content | Yes | No unsolicited @mentions, no identical cross-posting across accounts |
| Reply to users | Conditional | Only if the user engaged first — maximum one reply per interaction |
| Send Direct Messages | Conditional | Only after the user DMs first, with an easy opt-out |
| Like posts | Not automated | Auto-liking, bulk liking and selling likes are prohibited outright |
| Repost / quote | Conditional | Fine for informational use, not for bulk amplification |
| Follow / unfollow | Not automated | Bulk, aggressive or automated follow-back is not permitted |
Welcome messages to new followers are a specific trap: X’s guidance calls automated DMs to new followers unsolicited contact, even though the person already followed the account. The documented alternative is a pinned post, bio information, or an auto-reply that only fires once the user messages first.
Where automated accounts actually get flagged
- Bot posts and replies with no label and no bio disclosure — the account looks and behaves like a human one, which X’s guidelines classify as a deceptive bot regardless of intent.
- AI-generated replies deployed without the separate pre-approval step — a fully labeled account can still be in violation on content it never cleared first.
- Auto-liking sold or shipped as a product feature — likes must be user-initiated; automating them is listed as a standalone violation, not a gray area.
- Automated welcome DMs to new followers — treated as unsolicited outreach even when the recipient followed first.
- No human-managed account linked to the bot — breaks the accountability requirement even if every other box is checked.
- Any automation running outside the official X API — scraping or browser automation is its own permanent-suspension category.
Getting a compliant automated account live
- Map every automated action against the allowed listPosting, replying, DMing, liking, following — checked one by one against what X actually permits for that action, not against what the API technically lets you call.
- Set the profile-level disclosureThe Automated label, the bio line naming the operator, and the link to a human-managed account, configured together rather than added piecemeal after a warning.
- Build the opt-out path into the reply and DM logicKeyword detection for stop requests, wired in before launch rather than bolted on after a complaint.
- Flag any AI-generated output for pre-approvalIf the account’s replies or posts are AI-generated, that path is routed through X’s Policy Support form before the account goes live — not after.
- Confirm every call goes through the official APINo fallback scraping, no browser automation for anything the API does not yet cover.
What it looks like when this is set up correctly
Where this fits with the rest of your X API setup
Automation compliance is a separate layer from getting the API connection working in the first place. If the integration itself is still being built, the scope and permission model has to be right before disclosure settings matter at all — see X API OAuth 2.0 setup, PKCE and callback URLs and OAuth scopes vs app permission levels. Scheduling and automation platforms that post to X alongside other networks carry this same disclosure obligation on the X side specifically — see how that fits into a wider setup on the Postiz app approval and multi-platform API setup page.
I work on X API access, automation compliance and approval problems alongside Meta, Google and LinkedIn API work — mapping what a bot actually does against what X’s Developer Guidelines allow, and setting up the label, disclosure and opt-out layer correctly before launch.
Everything above is drawn from X’s official Developer Guidelines (docs.x.com) and Help Center (help.x.com) as published at the time of writing. Platform policies change without notice, and no specific outcome or timeline can be assured by anyone, including me. Verify against the current official documentation before you build.