The blocking mechanism on Instagram isn’t exactly well-designed:

Blocking someone allows you to be unblock-able from that account, while still being able to view its content freely, completely hidden for the other account (unblocking and re-blocking fastly).

There’s no way to know if someone is watching your stories or content if they have blocked you, since watching (with a script) for the split second they have unblocked you to see your content will rapidly lead to a rate-limiting error.

This is how blocking works in Instagram UIs:

  • If you block X, you’ll still be able to access its profile, with no contents showed, and unblock it.

  • X won’t see you anywhere. Not searching you, not in lists (Likes, Status views,…). X can’t access your account and can’t block you. Not even tagging someone and holding for more actions gives access to block an account, if that account already blocked you.

  • If X tries to access your account with a direct link, a page shows the content is not available.

  • Conversation disappears for the blocked (X), while still being there for the blocker.

The /web/friendships/PROFILE_ID/block/ POST endpoint, used by the Instagram web application, lets you block anyone, providing its PROFILE_ID.

You can easily get someone’s PROFILE_ID inspecting the web source of its profile (you don’t have to be logged in) and searching for this line

{
"logging_page_id":"profilePage_XXXXXXXXXX"
}

With XXXXXXXXXX being the PROFILE_ID (variable length).

If you try to block someone, watch for the Network requests tab in Developers tool and copy as CURL the executed request. You can replicate that request, replacing the PROFILE_ID to block someone who blocked you.

This is how the request looks like:

curl 'https://www.instagram.com/web/friendships/PROFILE_ID_TO_BLOCK/block/' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0' [...] SESSION THINGS AND COOKIES [...] -H 'Connection: keep-alive' —data ''

An “OK” response confirms the operation succeded.

Manually triggering this AJAX call leads to a broken situation between the two accounts. If one tries to access the other profile, a blank page with a server error appears, breaking the web application or the app. No one will be able to to unblock the other at this point using the UI.

Calling the /web/friendships/PROFILE_ID/unblock/ endpoint in the same way, allows you to unblock someone, reverting what we just did.