Facebook API

The Graph API is the primary way to get data into and out of Meta’s platforms: an HTTP based API that apps use to query data, publish content and manage objects. It is named after the social graph. The model is built from nodes, edges and fields: a node is a single object with a unique ID, an edge is a collection of objects under a node, and a field is one property of an object.

Transfers use HTTP/1.1 over HTTPS and requests go to the graph.facebook.com host. Calls should carry a version prefix, the letter v and a version number at the start of the request path, because an unversioned call uses the version configured in the app dashboard.

Access and tokens

An access token is an opaque string that identifies a user, an app or a Page, and it carries its own expiry and the app that generated it. Tokens follow OAuth 2.0, with the app and user IDs encoded inside them.

• User access token: obtained through a login dialog after the person grants permission.
• Page access token: exchange a user access token for a Page token through the Graph API; the /{user-id}/accounts endpoint returns the Pages a person can act on and a short-lived token for each.
• App access token: generated server to server with the app secret, and never hard-coded into client side code.
• System user token: for automated actions on ad objects or Pages without an app user.

Apps with Standard access to the Marketing API, and System user tokens, do not expire on time, though they can still be invalidated for other reasons.

Permissions and app review

For Page management the documentation lists pages_manage_posts, pages_manage_engagement, pages_manage_metadata, pages_read_engagement, pages_read_user_engagement and pages_show_list, plus publish_video.

• An app used by anyone without a role on it or in a Business that has claimed it must first undergo App Review.
• The Marketing API also requires App Review, with a few exceptions such as the Server-Side API. Its main permissions are ads_management and ads_read.
• Access is governed by the Platform Terms and the Developer Policies, and Meta may suspend an app for non-compliance.

Versions and lifecycle

The Graph API is released quarterly. A version operates for at least two years and becomes unusable two years after the next version is released; calls to it then default to the next oldest usable version.

Rate limits and errors

• Graph API requests fall under Platform Rate Limits, while Marketing API and Instagram Platform requests fall under Business Use Case (BUC) limits. For the Pages API the token decides: app or user tokens meet Platform limits, system user or Page tokens meet BUC limits. Where both could apply, BUC limits are applied.
• At app level the documented formula is 200 multiplied by the number of the app’s daily active users per rolling hour. Once the limit is reached, later requests fail until the call count drops below it.
• Usage appears in the X-App-Usage and X-Business-Use-Case-Usage headers as percentages.
• An error response is an error object with message, type, code, error_subcode and fbtrace_id fields; the trace id is an internal support identifier and expires shortly.
• Common codes: 190 for an expired or revoked token, 10 for a denied permission, 4 and 17 for temporary throttling, 368 for a temporary block for policy violations, 506 for a repeated post.

Further reading

• Graph API overview
• Versioning
• Rate Limits

At CyberElectro the Graph API is the interface our publishing flows use: n8n workflows and Postiz work with Page tokens, and Hermes Agent uses the same access.