A media upload to the Instagram API host (rupload_igphoto/,
rupload_igvideo/ and upload_settings/), decided by its path alone
(isInstagramUploadRequest, never declared). The Android 451 app sends
it with its own header set: the app-surface identity and the session
pair like an API request, the upload's own priority, friendly name and
media_upload tags, and no navigation chain.
The app's music player downloading a catalog song, declared by its builder (the
request goes to a CDN host, so no host rule can name it). It carries neither
credentials nor any x-ig-* header: the server's cookie-free media request set of a
signed-in process — the player's own analytics tags and priority, the byte range, the
player's cache key and buffered-ahead time, and the process's network session.
A media upload to
rupload.facebook.com, decided by the host alone (isMediaUploadRequest, never declared). Its own header kind (Android: the session identity, the routing map, the USDID and the zero state, but not the app-identifying, Bloks/prism, device-id, navigation or bandwidth headers an API request carries), and its answers are not the API's.