This is the conclusive source proving that X accesses Twitter analytics via API.
You can see from this CORS error log:
Access to fetch at 'analytics.twitter.com/measurement/pe…' from origin 'x.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
---
Access to fetch at 'analytics.twitter.com/measurement/...'
has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested resource.